modiloader | c4fb47fd9abb01465a421c6e0412852ba422d892e6ddf533432e356b229a1995

General

Target

Formulaire.cmd
Size

4.4MB
MD5

3a4ee24bb4e30149488acb8b5b807dfa
SHA1

cdaac84ebe682dd75942886fece7286e7afcf816
SHA256

c4fb47fd9abb01465a421c6e0412852ba422d892e6ddf533432e356b229a1995
SHA512

d1dc8a3ba2754fa979addad77e1275f808270a4f47455af27b8dcf302a91086ab3f79fd5212dec8964116fd717ff1aa3e6aed6c277141d8bd504fd3d03b2ed20
SSDEEP

49152:9qn6yInGos9t2oOfPUlIVHpkIuTErOSqcNX6xro0b+mZrRQNMg0Qw9eizGvp:h

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3028-35-0x0000000003040000-0x0000000004040000-memory.dmp	modiloader_stage2

Executes dropped EXE 8 IoCs

Processes:

alpha.exealpha.exekn.exealpha.exekn.exesppsvc.pifalpha.exealpha.exe

pid process

3008 alpha.exe
2624 alpha.exe
2684 kn.exe
2552 alpha.exe
2604 kn.exe
3028 sppsvc.pif
2560 alpha.exe
2420 alpha.exe
Loads dropped DLL 9 IoCs

Processes:

cmd.exealpha.exealpha.exeWerFault.exe

pid process

1712 cmd.exe
1712 cmd.exe
2624 alpha.exe
1712 cmd.exe
2552 alpha.exe
1712 cmd.exe
1712 cmd.exe
2052 WerFault.exe
2052 WerFault.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2052 3028 WerFault.exe sppsvc.pif
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

sppsvc.pif

pid process

3028 sppsvc.pif

pid	process
3008	alpha.exe
2624	alpha.exe
2684	kn.exe
2552	alpha.exe
2604	kn.exe
3028	sppsvc.pif
2560	alpha.exe
2420	alpha.exe

pid	process
1712	cmd.exe
1712	cmd.exe
2624	alpha.exe
1712	cmd.exe
2552	alpha.exe
1712	cmd.exe
1712	cmd.exe
2052	WerFault.exe
2052	WerFault.exe

pid	pid_target	process	target process
2052	3028	WerFault.exe	sppsvc.pif

pid	process
3028	sppsvc.pif

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

cmd.exealpha.exealpha.exealpha.exesppsvc.pif

description	pid	process	target process
PID 1712 wrote to memory of 3012	1712	cmd.exe	extrac32.exe
PID 1712 wrote to memory of 3012	1712	cmd.exe	extrac32.exe
PID 1712 wrote to memory of 3012	1712	cmd.exe	extrac32.exe
PID 1712 wrote to memory of 3008	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 3008	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 3008	1712	cmd.exe	alpha.exe
PID 3008 wrote to memory of 2504	3008	alpha.exe	extrac32.exe
PID 3008 wrote to memory of 2504	3008	alpha.exe	extrac32.exe
PID 3008 wrote to memory of 2504	3008	alpha.exe	extrac32.exe
PID 1712 wrote to memory of 2624	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 2624	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 2624	1712	cmd.exe	alpha.exe
PID 2624 wrote to memory of 2684	2624	alpha.exe	kn.exe
PID 2624 wrote to memory of 2684	2624	alpha.exe	kn.exe
PID 2624 wrote to memory of 2684	2624	alpha.exe	kn.exe
PID 1712 wrote to memory of 2552	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 2552	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 2552	1712	cmd.exe	alpha.exe
PID 2552 wrote to memory of 2604	2552	alpha.exe	kn.exe
PID 2552 wrote to memory of 2604	2552	alpha.exe	kn.exe
PID 2552 wrote to memory of 2604	2552	alpha.exe	kn.exe
PID 1712 wrote to memory of 3028	1712	cmd.exe	sppsvc.pif
PID 1712 wrote to memory of 3028	1712	cmd.exe	sppsvc.pif
PID 1712 wrote to memory of 3028	1712	cmd.exe	sppsvc.pif
PID 1712 wrote to memory of 3028	1712	cmd.exe	sppsvc.pif
PID 1712 wrote to memory of 2560	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 2560	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 2560	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 2420	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 2420	1712	cmd.exe	alpha.exe
PID 1712 wrote to memory of 2420	1712	cmd.exe	alpha.exe
PID 3028 wrote to memory of 2052	3028	sppsvc.pif	WerFault.exe
PID 3028 wrote to memory of 2052	3028	sppsvc.pif	WerFault.exe
PID 3028 wrote to memory of 2052	3028	sppsvc.pif	WerFault.exe
PID 3028 wrote to memory of 2052	3028	sppsvc.pif	WerFault.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Formulaire.cmd"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\System32\extrac32.exe
C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
2⤵
PID:3012

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\system32\extrac32.exe
extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
3⤵
PID:2504

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Formulaire.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Formulaire.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9
3⤵
- Executes dropped EXE
PID:2684

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12
3⤵
- Executes dropped EXE
PID:2604

C:\Users\Public\Libraries\sppsvc.pif
C:\Users\Public\Libraries\sppsvc.pif
2⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 700
3⤵
- Loads dropped DLL
- Program crash
PID:2052

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\sppsvc.rtf" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:2560

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Libraries\sppsvc.pif
Filesize
1.6MB

MD5
e83dc541d9852ffab84ccdbf20b4b45f

SHA1
12bd8c9b9f97831e8131f64b532705d11b56d85e

SHA256
f85f2e99b8630fbd384e7847aee11692acd9a1e8132ab6c768c0a286c08310f8

SHA512
8c93667fbed45a70a9daf791a1cd18e2d74c9fa9b45238658cd85bf898b5b688d245dbe55b9115393c5ed8200f6dd2c276904896661839e770ca8f5725a42544

Download Submit
C:\Users\Public\kn.exe
Filesize
1.1MB

MD5
ec1fd3050dbc40ec7e87ab99c7ca0b03

SHA1
ae7fdfc29f4ef31e38ebf381e61b503038b5cb35

SHA256
1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3

SHA512
4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2

Download Submit
C:\Users\Public\sppsvc.rtf
Filesize
3.2MB

MD5
b40837f9ab31d86cdb23ccbfffcd6cb9

SHA1
4b1455ba4d8bdd088abbb3ca40096a1e4ace9d64

SHA256
888be676e0ac05d20d0046c6c6d483cc33b2e245fa3714aa496239c4fa25a4a6

SHA512
ce29d9b548106353c52328f7732552765ac19d1021ce1aa5f1d727f45469469a0585409cf0eb47049674326616ea4b1215bcf0811067ab6644e70b47e5e71bcd

Download Submit
\Users\Public\alpha.exe
Filesize
337KB

MD5
5746bd7e255dd6a8afa06f7c42c1ba41

SHA1
0f3c4ff28f354aede202d54e9d1c5529a3bf87d8

SHA256
db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386

SHA512
3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

Download Submit
memory/3028-32-0x0000000003040000-0x0000000004040000-memory.dmp

Filesize
16.0MB

Download
memory/3028-35-0x0000000003040000-0x0000000004040000-memory.dmp

Filesize
16.0MB

Download
memory/3028-37-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads