modiloader | c9fa5ed936b3c7dde4c90b453c9bc95f08beb8d06af8e59dc02f4526b7fee017

General

Target

invoice_569685.cmd
Size

3.2MB
MD5

a44d0923af9248d5844169ae5e465b5d
SHA1

9478acd0c7c630a51ec64a553a135a3f50d135bb
SHA256

7d2e08e27b338c8a834d696def4ff2f541e6b19e4d550f42b5c5423fb455e56a
SHA512

1035a085fb6c5f94347048433a5b2c78ff23ffff69bcca9114ad4f9e36ea048022652a8234f54912e5ee1c372c66dae6a5d4d4c60fdae2c1d3347abb7a3b2faf
SSDEEP

49152:6oxyJptV+hMsrY2Dp1wrmaKY4L/A2v7380MG3LFQzPLDgV4R:K

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 64 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1764-30-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-31-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-32-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-29-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-28-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-33-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-35-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-36-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-38-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-40-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-43-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-44-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-53-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-71-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-91-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-90-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-88-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-87-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-85-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-83-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-82-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-81-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-78-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-77-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-76-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-75-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-74-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-73-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-72-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-89-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-86-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-84-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-80-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-79-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-66-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-63-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-70-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-69-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-68-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-67-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-65-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-56-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-64-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-55-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-62-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-61-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-54-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-48-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-60-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-59-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-52-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-58-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-51-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-57-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-50-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-49-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-47-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-46-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-45-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-42-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-41-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-39-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-37-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-34-0x0000000002A40000-0x0000000003A40000-memory.dmp	modiloader_stage2

Executes dropped EXE 8 IoCs

Processes:

alpha.exealpha.exekn.exealpha.exekn.exeAudio.pifalpha.exealpha.exe

pid process

4352 alpha.exe
1724 alpha.exe
4240 kn.exe
4016 alpha.exe
3060 kn.exe
1764 Audio.pif
3860 alpha.exe
4860 alpha.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service
T1102

Processes:

flow ioc

13 drive.google.com
14 drive.google.com
15 drive.google.com
16 drive.google.com
4 drive.google.com
9 drive.google.com
11 drive.google.com

pid	process
4352	alpha.exe
1724	alpha.exe
4240	kn.exe
4016	alpha.exe
3060	kn.exe
1764	Audio.pif
3860	alpha.exe
4860	alpha.exe

flow	ioc
13	drive.google.com
14	drive.google.com
15	drive.google.com
16	drive.google.com
4	drive.google.com
9	drive.google.com
11	drive.google.com

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

cmd.exealpha.exealpha.exealpha.exe

description	pid	process	target process
PID 3672 wrote to memory of 3128	3672	cmd.exe	extrac32.exe
PID 3672 wrote to memory of 3128	3672	cmd.exe	extrac32.exe
PID 3672 wrote to memory of 4352	3672	cmd.exe	alpha.exe
PID 3672 wrote to memory of 4352	3672	cmd.exe	alpha.exe
PID 4352 wrote to memory of 2564	4352	alpha.exe	extrac32.exe
PID 4352 wrote to memory of 2564	4352	alpha.exe	extrac32.exe
PID 3672 wrote to memory of 1724	3672	cmd.exe	alpha.exe
PID 3672 wrote to memory of 1724	3672	cmd.exe	alpha.exe
PID 1724 wrote to memory of 4240	1724	alpha.exe	kn.exe
PID 1724 wrote to memory of 4240	1724	alpha.exe	kn.exe
PID 3672 wrote to memory of 4016	3672	cmd.exe	alpha.exe
PID 3672 wrote to memory of 4016	3672	cmd.exe	alpha.exe
PID 4016 wrote to memory of 3060	4016	alpha.exe	kn.exe
PID 4016 wrote to memory of 3060	4016	alpha.exe	kn.exe
PID 3672 wrote to memory of 1764	3672	cmd.exe	Audio.pif
PID 3672 wrote to memory of 1764	3672	cmd.exe	Audio.pif
PID 3672 wrote to memory of 1764	3672	cmd.exe	Audio.pif
PID 3672 wrote to memory of 3860	3672	cmd.exe	alpha.exe
PID 3672 wrote to memory of 3860	3672	cmd.exe	alpha.exe
PID 3672 wrote to memory of 4860	3672	cmd.exe	alpha.exe
PID 3672 wrote to memory of 4860	3672	cmd.exe	alpha.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\invoice_569685.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3672

C:\Windows\System32\extrac32.exe
C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
2⤵
PID:3128

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352

C:\Windows\system32\extrac32.exe
extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
3⤵
PID:2564

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\invoice_569685.cmd" "C:\\Users\\Public\\Audio.mp4" 9
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\invoice_569685.cmd" "C:\\Users\\Public\\Audio.mp4" 9
3⤵
- Executes dropped EXE
PID:4240

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 12
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 12
3⤵
- Executes dropped EXE
PID:3060

C:\Users\Public\Libraries\Audio.pif
C:\Users\Public\Libraries\Audio.pif
2⤵
- Executes dropped EXE
PID:1764

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:3860

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Audio.mp4" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:4860

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Audio.mp4
Filesize
2.1MB

MD5
331acc128c73ca34df0ec4f2773a909d

SHA1
49efefcf09d9d1e7df14b12e937c78f64d30cd91

SHA256
c5d8ddff9277aa014c2612f57059eb7963a5ee7f9393b8dda53c6fedbb93646d

SHA512
cf549dbbfa3101f4587c4508fc6b9243831eb41a61ac1b75a8bf78f0d5350a6d50fcc840ae85163368b1254ab532259c0b9fc48053655d6e1dff3434677e65b3

Download Submit
C:\Users\Public\Libraries\Audio.pif
Filesize
1.1MB

MD5
a7665a0ba38d413a4186778d0b589419

SHA1
fc281f3d97b91799ce0a0f90da106681810de663

SHA256
f9455699d8c8e96c69cb3c8e87336c34655b2f1c39fee7256ead815c444d39b0

SHA512
741ba77391db3d64deed3811b2024c91d5cc63c05294bf787ddab0d4dde2b434511f10ea08f466b11db1302a485e6ab04c92eb3ef971de2ad325a16a775e6220

Download Submit
C:\Users\Public\alpha.exe
Filesize
283KB

MD5
8a2122e8162dbef04694b9c3e0b6cdee

SHA1
f1efb0fddc156e4c61c5f78a54700e4e7984d55d

SHA256
b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

SHA512
99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

Download Submit
C:\Users\Public\kn.exe
Filesize
1.6MB

MD5
bd8d9943a9b1def98eb83e0fa48796c2

SHA1
70e89852f023ab7cde0173eda1208dbb580f1e4f

SHA256
8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2

SHA512
95630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b

Download Submit
memory/1764-30-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-31-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-32-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-29-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-28-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-33-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-35-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-36-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-38-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-40-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-43-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-44-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-53-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-71-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-91-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-90-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-88-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-87-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-85-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-83-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-82-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-81-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-78-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-77-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-76-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-75-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-74-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-73-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-72-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-89-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-86-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-84-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-80-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-79-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-66-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-63-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-70-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-69-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-68-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-67-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-65-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-56-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-64-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-55-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-62-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-61-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-54-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-48-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-60-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-59-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-52-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-58-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-51-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-57-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-50-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-49-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-47-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-46-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-45-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-42-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-41-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-39-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-37-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download
memory/1764-34-0x0000000002A40000-0x0000000003A40000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing