modiloader | 6ff59a7a9bb26552d874bf03ffd04b7c152184e443d09f79a4f2459f8a04dd55

General

Target

hesaphareketi-01.cmd
Size

4.3MB
MD5

a4be8d3b4bcc7db0198c4b47d86cce16
SHA1

a18a8390e914debee1172c82e43c784f525009c7
SHA256

6ff59a7a9bb26552d874bf03ffd04b7c152184e443d09f79a4f2459f8a04dd55
SHA512

6cab41c6d7a72e08bb880311d3ec4996fe0cb265b5125e1b7eb451e11914644b2ef18487bacb607bb1eb9cdbb7c3f53bbb3ba403d6e961f9a5aa0cbb61aa12e1
SSDEEP

24576:45Mrv/oEbMykRyeB182egMdyhXTKrXscV/bcsHuurHP0OSRB/KdHQO+j7G/0Rxa8:4KrDQy0P82syhXTdO/Q2BP05idd8dko

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 57 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2632-34-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-37-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-38-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-36-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-35-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-41-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-42-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-44-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-40-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-43-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-46-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-49-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-48-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-47-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-50-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-53-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-55-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-54-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-57-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-56-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-62-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-59-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-63-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-61-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-60-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-65-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-69-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-68-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-67-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-66-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-71-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-70-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-73-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-72-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-74-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-77-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-84-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-122-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-120-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-118-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-116-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-113-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-111-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-109-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-108-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-106-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-103-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-101-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-99-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-96-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-94-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-92-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-89-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-87-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-82-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-78-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-76-0x00000000033A0000-0x00000000043A0000-memory.dmp	modiloader_stage2

Executes dropped EXE 8 IoCs

Processes:

alpha.exealpha.exekn.exealpha.exekn.exeAudio.pifalpha.exealpha.exe

pid process

2460 alpha.exe
1972 alpha.exe
2596 kn.exe
2692 alpha.exe
2716 kn.exe
2632 Audio.pif
2728 alpha.exe
2672 alpha.exe
Loads dropped DLL 7 IoCs

Processes:

cmd.exealpha.exealpha.exe

pid process

1644 cmd.exe
1644 cmd.exe
1972 alpha.exe
1644 cmd.exe
2692 alpha.exe
1644 cmd.exe
1644 cmd.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

Audio.pif

pid process

2632 Audio.pif

pid	process
2460	alpha.exe
1972	alpha.exe
2596	kn.exe
2692	alpha.exe
2716	kn.exe
2632	Audio.pif
2728	alpha.exe
2672	alpha.exe

pid	process
1644	cmd.exe
1644	cmd.exe
1972	alpha.exe
1644	cmd.exe
2692	alpha.exe
1644	cmd.exe
1644	cmd.exe

pid	process
2632	Audio.pif

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

cmd.exealpha.exealpha.exealpha.exe

description	pid	process	target process
PID 1644 wrote to memory of 2036	1644	cmd.exe	extrac32.exe
PID 1644 wrote to memory of 2036	1644	cmd.exe	extrac32.exe
PID 1644 wrote to memory of 2036	1644	cmd.exe	extrac32.exe
PID 1644 wrote to memory of 2460	1644	cmd.exe	alpha.exe
PID 1644 wrote to memory of 2460	1644	cmd.exe	alpha.exe
PID 1644 wrote to memory of 2460	1644	cmd.exe	alpha.exe
PID 2460 wrote to memory of 2772	2460	alpha.exe	extrac32.exe
PID 2460 wrote to memory of 2772	2460	alpha.exe	extrac32.exe
PID 2460 wrote to memory of 2772	2460	alpha.exe	extrac32.exe
PID 1644 wrote to memory of 1972	1644	cmd.exe	alpha.exe
PID 1644 wrote to memory of 1972	1644	cmd.exe	alpha.exe
PID 1644 wrote to memory of 1972	1644	cmd.exe	alpha.exe
PID 1972 wrote to memory of 2596	1972	alpha.exe	kn.exe
PID 1972 wrote to memory of 2596	1972	alpha.exe	kn.exe
PID 1972 wrote to memory of 2596	1972	alpha.exe	kn.exe
PID 1644 wrote to memory of 2692	1644	cmd.exe	alpha.exe
PID 1644 wrote to memory of 2692	1644	cmd.exe	alpha.exe
PID 1644 wrote to memory of 2692	1644	cmd.exe	alpha.exe
PID 2692 wrote to memory of 2716	2692	alpha.exe	kn.exe
PID 2692 wrote to memory of 2716	2692	alpha.exe	kn.exe
PID 2692 wrote to memory of 2716	2692	alpha.exe	kn.exe
PID 1644 wrote to memory of 2632	1644	cmd.exe	Audio.pif
PID 1644 wrote to memory of 2632	1644	cmd.exe	Audio.pif
PID 1644 wrote to memory of 2632	1644	cmd.exe	Audio.pif
PID 1644 wrote to memory of 2632	1644	cmd.exe	Audio.pif
PID 1644 wrote to memory of 2728	1644	cmd.exe	alpha.exe
PID 1644 wrote to memory of 2728	1644	cmd.exe	alpha.exe
PID 1644 wrote to memory of 2728	1644	cmd.exe	alpha.exe
PID 1644 wrote to memory of 2672	1644	cmd.exe	alpha.exe
PID 1644 wrote to memory of 2672	1644	cmd.exe	alpha.exe
PID 1644 wrote to memory of 2672	1644	cmd.exe	alpha.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.cmd"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\System32\extrac32.exe
C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
2⤵
PID:2036

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\system32\extrac32.exe
extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
3⤵
PID:2772

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.cmd" "C:\\Users\\Public\\Audio.mp4" 9
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.cmd" "C:\\Users\\Public\\Audio.mp4" 9
3⤵
- Executes dropped EXE
PID:2596

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 12
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692

C:\Users\Public\kn.exe
C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 12
3⤵
- Executes dropped EXE
PID:2716

C:\Users\Public\Libraries\Audio.pif
C:\Users\Public\Libraries\Audio.pif
2⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2632

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:2728

C:\Users\Public\alpha.exe
C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Audio.mp4" / A / F / Q / S
2⤵
- Executes dropped EXE
PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Audio.mp4
Filesize
3.0MB

MD5
2b394a65ee90021cb0990dbdb9ee43bb

SHA1
341e96b53dfb4831dfe1f3334cfb6405df173f52

SHA256
e106349c4b793aac809fd7b11dca2cf1a293fecd584071e9ed0b48cb0bdff857

SHA512
51eae123e69dbf6d040d88f8984b9cdb8de16c0035f05a0c355c3f2d9b372706a7c8e6bf554051842980fb043328350d380c6590ac05cefb0996ddd9a9bd3680

Download Submit
C:\Users\Public\Libraries\Audio.pif
Filesize
1.5MB

MD5
1a7ed7270f975e1aedd73a800e17a40b

SHA1
6a7b00eb876108cbbcbeaef40448ecf34a518d59

SHA256
a6d0ab763d30f720839b50458cf1e4ab601f5574dd6d835aa17488535e89bd3b

SHA512
289ef44a7e171145232f497075596bdba81f53016a8d16935a20069396f91548e5643b1fab2264613f54cb34c12974529ab01fd6e5b3a78708557df2e00781f7

Download Submit
\Users\Public\alpha.exe
Filesize
337KB

MD5
5746bd7e255dd6a8afa06f7c42c1ba41

SHA1
0f3c4ff28f354aede202d54e9d1c5529a3bf87d8

SHA256
db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386

SHA512
3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e

Download Submit
\Users\Public\kn.exe
Filesize
1.1MB

MD5
ec1fd3050dbc40ec7e87ab99c7ca0b03

SHA1
ae7fdfc29f4ef31e38ebf381e61b503038b5cb35

SHA256
1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3

SHA512
4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2

Download Submit
memory/2632-34-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-37-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-38-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-36-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-35-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-39-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/2632-41-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-42-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-44-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-40-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-43-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-46-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-49-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-48-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-47-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-50-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-53-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-55-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-54-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-57-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-56-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-62-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-59-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-63-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-61-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-60-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-65-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-69-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-68-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-67-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-66-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-71-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-70-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-73-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-72-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-74-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-77-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-84-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-122-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-120-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-118-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-116-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-113-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-111-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-109-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-108-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-106-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-103-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-101-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-99-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-96-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-94-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-92-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-89-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-87-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-82-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-78-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download
memory/2632-76-0x00000000033A0000-0x00000000043A0000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads