modiloader | 3166d24662d79692997f4f945366316d677b0cd6659b3aeeb6894dff2ed4b33a

General

Target

318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
Size

112KB
MD5

318b8e995675dd1844e521e0d841db80
SHA1

d7f40c955c9ab4cab64e16d0a1302ef2a548c897
SHA256

3166d24662d79692997f4f945366316d677b0cd6659b3aeeb6894dff2ed4b33a
SHA512

4745fd91866973f443f8bd1d9a30a7948ac721386c59c26a7dbe3869d3a8ac3cdded83823dad6df6d05aaa722d6307e2436e304c922fe3880dddeb93c4dfb521
SSDEEP

1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5

Score

10^/10

modiloader persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1640-60-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/1640-62-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/1640-63-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/1640-68-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe

Executes dropped EXE 3 IoCs

Processes:

WAMain.exeWAMain.exeWAMain.exe

pid process

2364 WAMain.exe
4120 WAMain.exe
1640 WAMain.exe

pid	process
2364	WAMain.exe
4120	WAMain.exe
1640	WAMain.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2828-13-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2828-12-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2828-7-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/1640-52-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/1640-60-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/1640-59-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/1640-62-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/2828-66-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/1640-63-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/1640-68-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/4120-67-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows WA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WAMain.exe"	reg.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exeWAMain.exe

description	pid	process	target process
PID 2428 set thread context of 2968	2428	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	svchost.exe
PID 2428 set thread context of 2828	2428	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
PID 2364 set thread context of 3372	2364	WAMain.exe	svchost.exe
PID 2364 set thread context of 4120	2364	WAMain.exe	WAMain.exe
PID 2364 set thread context of 1640	2364	WAMain.exe	WAMain.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4588 2968 WerFault.exe svchost.exe

pid	pid_target	process	target process
4588	2968	WerFault.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exe

pid	process
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe
3372	svchost.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

WAMain.exe

description	pid	process
Token: SeDebugPrivilege	4120	WAMain.exe
Token: SeDebugPrivilege	4120	WAMain.exe
Token: SeDebugPrivilege	4120	WAMain.exe
Token: SeDebugPrivilege	4120	WAMain.exe
Token: SeDebugPrivilege	4120	WAMain.exe
Token: SeDebugPrivilege	4120	WAMain.exe
Token: SeDebugPrivilege	4120	WAMain.exe
Token: SeDebugPrivilege	4120	WAMain.exe
Token: SeDebugPrivilege	4120	WAMain.exe
Token: SeDebugPrivilege	4120	WAMain.exe
Token: SeDebugPrivilege	4120	WAMain.exe
Token: SeDebugPrivilege	4120	WAMain.exe
Token: SeDebugPrivilege	4120	WAMain.exe
Token: SeDebugPrivilege	4120	WAMain.exe
Token: SeDebugPrivilege	4120	WAMain.exe
Token: SeDebugPrivilege	4120	WAMain.exe
Token: SeDebugPrivilege	4120	WAMain.exe
Token: SeDebugPrivilege	4120	WAMain.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exeWAMain.exesvchost.exeWAMain.exe

pid	process
2428	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
2828	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
2364	WAMain.exe
3372	svchost.exe
4120	WAMain.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe318b8e995675dd1844e521e0d841db80_NeikiAnalytics.execmd.exeWAMain.exe

description	pid	process	target process
PID 2428 wrote to memory of 2968	2428	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	svchost.exe
PID 2428 wrote to memory of 2968	2428	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	svchost.exe
PID 2428 wrote to memory of 2968	2428	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	svchost.exe
PID 2428 wrote to memory of 2968	2428	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	svchost.exe
PID 2428 wrote to memory of 2828	2428	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
PID 2428 wrote to memory of 2828	2428	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
PID 2428 wrote to memory of 2828	2428	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
PID 2428 wrote to memory of 2828	2428	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
PID 2428 wrote to memory of 2828	2428	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
PID 2428 wrote to memory of 2828	2428	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
PID 2428 wrote to memory of 2828	2428	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
PID 2428 wrote to memory of 2828	2428	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
PID 2828 wrote to memory of 4452	2828	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	cmd.exe
PID 2828 wrote to memory of 4452	2828	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	cmd.exe
PID 2828 wrote to memory of 4452	2828	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	cmd.exe
PID 4452 wrote to memory of 3784	4452	cmd.exe	reg.exe
PID 4452 wrote to memory of 3784	4452	cmd.exe	reg.exe
PID 4452 wrote to memory of 3784	4452	cmd.exe	reg.exe
PID 2828 wrote to memory of 2364	2828	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	WAMain.exe
PID 2828 wrote to memory of 2364	2828	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	WAMain.exe
PID 2828 wrote to memory of 2364	2828	318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe	WAMain.exe
PID 2364 wrote to memory of 3372	2364	WAMain.exe	svchost.exe
PID 2364 wrote to memory of 3372	2364	WAMain.exe	svchost.exe
PID 2364 wrote to memory of 3372	2364	WAMain.exe	svchost.exe
PID 2364 wrote to memory of 3372	2364	WAMain.exe	svchost.exe
PID 2364 wrote to memory of 3372	2364	WAMain.exe	svchost.exe
PID 2364 wrote to memory of 3372	2364	WAMain.exe	svchost.exe
PID 2364 wrote to memory of 3372	2364	WAMain.exe	svchost.exe
PID 2364 wrote to memory of 3372	2364	WAMain.exe	svchost.exe
PID 2364 wrote to memory of 3372	2364	WAMain.exe	svchost.exe
PID 2364 wrote to memory of 4120	2364	WAMain.exe	WAMain.exe
PID 2364 wrote to memory of 4120	2364	WAMain.exe	WAMain.exe
PID 2364 wrote to memory of 4120	2364	WAMain.exe	WAMain.exe
PID 2364 wrote to memory of 4120	2364	WAMain.exe	WAMain.exe
PID 2364 wrote to memory of 4120	2364	WAMain.exe	WAMain.exe
PID 2364 wrote to memory of 4120	2364	WAMain.exe	WAMain.exe
PID 2364 wrote to memory of 4120	2364	WAMain.exe	WAMain.exe
PID 2364 wrote to memory of 4120	2364	WAMain.exe	WAMain.exe
PID 2364 wrote to memory of 1640	2364	WAMain.exe	WAMain.exe
PID 2364 wrote to memory of 1640	2364	WAMain.exe	WAMain.exe
PID 2364 wrote to memory of 1640	2364	WAMain.exe	WAMain.exe
PID 2364 wrote to memory of 1640	2364	WAMain.exe	WAMain.exe
PID 2364 wrote to memory of 1640	2364	WAMain.exe	WAMain.exe
PID 2364 wrote to memory of 1640	2364	WAMain.exe	WAMain.exe
PID 2364 wrote to memory of 1640	2364	WAMain.exe	WAMain.exe
PID 2364 wrote to memory of 1640	2364	WAMain.exe	WAMain.exe

C:\Users\Admin\AppData\Local\Temp\318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\system32\svchost.exe"
2⤵
PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 84
3⤵
- Program crash
PID:4588

C:\Users\Admin\AppData\Local\Temp\318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\318b8e995675dd1844e521e0d841db80_NeikiAnalytics.exe"
2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GFSIW.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:4452

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows WA" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe" /f
4⤵
- Adds Run key to start application
PID:3784

C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\system32\svchost.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3372

C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4120

C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe"
4⤵
- Executes dropped EXE
PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2968 -ip 2968
1⤵
PID:3856

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GFSIW.txt
Filesize
148B

MD5
3a4614705555abb049c3298e61170b7f

SHA1
c8686410756f346d9551256a5b878b04770950ba

SHA256
cff0663c8cfadf83b80583a871c313ffc5d950cb503809cb4a482f400c5d846b

SHA512
65ce6fec00e6934f21635e7ccd74757f31ed4b0ddb52bd80d3ea9abeba56340128d23151ef7d9f5daacb5d61e4a4cca50dbb3a43132e350522311ee06e829007

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\WAMain.exe
Filesize
112KB

MD5
4554db0c5b3be2bfcaea269c7d05645a

SHA1
e9af34f269f1abf8fe0fe2ccb1ea973986849d75

SHA256
b33a05f2e1e005d8b114c8072f50a6198aba5e4aff5ebc10a8a9b6346f2d1523

SHA512
d7ef5ca9e5f9b947054800ab41579bf30e5a25277f46bec4d085ab68a1b0b7e5b846c94a60319b077a4bbfe6e7187774338e58eec611ce18bb48c3e68f5d0e6c

Download Submit
memory/1640-68-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1640-63-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1640-62-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1640-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1640-60-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1640-52-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2364-41-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2364-39-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2364-55-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2364-40-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2428-5-0x0000000002A30000-0x0000000002A32000-memory.dmp

Filesize
8KB

Download
memory/2428-9-0x0000000002A70000-0x0000000002A72000-memory.dmp

Filesize
8KB

Download
memory/2428-3-0x00000000029E0000-0x00000000029E2000-memory.dmp

Filesize
8KB

Download
memory/2428-10-0x0000000002BF0000-0x0000000002BF2000-memory.dmp

Filesize
8KB

Download
memory/2428-2-0x0000000002180000-0x0000000002182000-memory.dmp

Filesize
8KB

Download
memory/2428-4-0x0000000002A00000-0x0000000002A02000-memory.dmp

Filesize
8KB

Download
memory/2428-8-0x0000000002A40000-0x0000000002A42000-memory.dmp

Filesize
8KB

Download
memory/2828-12-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2828-13-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2828-7-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2828-66-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3372-56-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3372-46-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3372-42-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3372-49-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3372-71-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4120-67-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads