modiloader | 39c526c0e514a316dd3543eec30e7e8a92b1aef715897e7fe3833902a7cf3bc3

Analysis

max time kernel
143s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39c526c0e514a316dd3543eec30e7e8a92b1aef715897e7fe3833902a7cf3bc3.bat
Size

6.3MB
MD5

ff9b413f71937d07ec92a927d0b40b72
SHA1

9ba71de70f0b559b3f44c13612b928c9e5399418
SHA256

39c526c0e514a316dd3543eec30e7e8a92b1aef715897e7fe3833902a7cf3bc3
SHA512

d5373457e226a6e5ff4d01f1b0729a0153310960b6b25f5f28c2e1554bb89ffa0c5d6bdd18a39a278f61a32f8c11152ae784f37e1dd082838afd46c1fac8a06e
SSDEEP

49152:rwwXxjCN45WUd/Apb9rX9tNVWOf0aRzePuQvZfnSWTKMqIl5ec2HKhv3AVkoeXrP:B

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/5048-30-0x0000000002C80000-0x0000000003C80000-memory.dmp	modiloader_stage2

Executes dropped EXE 8 IoCs

pid	Process
880	alpha.exe
3492	alpha.exe
1412	kn.exe
4272	alpha.exe
1632	kn.exe
5048	spoolsv.COM
1256	alpha.exe
2100	alpha.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.COM

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 1424	4028	cmd.exe	88
PID 4028 wrote to memory of 1424	4028	cmd.exe	88
PID 4028 wrote to memory of 880	4028	cmd.exe	89
PID 4028 wrote to memory of 880	4028	cmd.exe	89
PID 880 wrote to memory of 2108	880	alpha.exe	90
PID 880 wrote to memory of 2108	880	alpha.exe	90
PID 4028 wrote to memory of 3492	4028	cmd.exe	91
PID 4028 wrote to memory of 3492	4028	cmd.exe	91
PID 3492 wrote to memory of 1412	3492	alpha.exe	92
PID 3492 wrote to memory of 1412	3492	alpha.exe	92
PID 4028 wrote to memory of 4272	4028	cmd.exe	93
PID 4028 wrote to memory of 4272	4028	cmd.exe	93
PID 4272 wrote to memory of 1632	4272	alpha.exe	94
PID 4272 wrote to memory of 1632	4272	alpha.exe	94
PID 4028 wrote to memory of 5048	4028	cmd.exe	95
PID 4028 wrote to memory of 5048	4028	cmd.exe	95
PID 4028 wrote to memory of 5048	4028	cmd.exe	95
PID 4028 wrote to memory of 1256	4028	cmd.exe	96
PID 4028 wrote to memory of 1256	4028	cmd.exe	96
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 4028 wrote to memory of 2100	4028	cmd.exe	97
PID 4028 wrote to memory of 2100	4028	cmd.exe	97
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM
PID 5048 wrote to memory of 0	5048	spoolsv.COM

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\39c526c0e514a316dd3543eec30e7e8a92b1aef715897e7fe3833902a7cf3bc3.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\System32\extrac32.exe
  C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
  2⤵
  PID:1424
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Windows\system32\extrac32.exe
    extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
    3⤵
    PID:2108
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\39c526c0e514a316dd3543eec30e7e8a92b1aef715897e7fe3833902a7cf3bc3.bat" "C:\\Users\\Public\\spoolsv.MPEG" 3
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Users\Public\kn.exe
    C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\39c526c0e514a316dd3543eec30e7e8a92b1aef715897e7fe3833902a7cf3bc3.bat" "C:\\Users\\Public\\spoolsv.MPEG" 3
    3⤵
    - Executes dropped EXE
    PID:1412
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\spoolsv.MPEG" "C:\\Users\\Public\\Libraries\\spoolsv.COM" 10
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Users\Public\kn.exe
    C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\spoolsv.MPEG" "C:\\Users\\Public\\Libraries\\spoolsv.COM" 10
    3⤵
    - Executes dropped EXE
    PID:1632
- C:\Users\Public\Libraries\spoolsv.COM
  C:\Users\Public\Libraries\spoolsv.COM
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5048
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\spoolsv.MPEG" / A / F / Q / S
  2⤵
  - Executes dropped EXE
  PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,12470628711992022444,7767535593390851522,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:8
1⤵
PID:688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Libraries\spoolsv.COM

Filesize
1.3MB

MD5
93f9544a57c66db2a89f711bc87b2bcf

SHA1
7b55183c9a0c38bcb778deff3f0534690edba1a1

SHA256
6a521f811e449a60a689fbd30ed47be775bdc73cba6c9a99dc927f7bf720a11a

SHA512
df9ea524733645b1f179cb1b4d1e1f040a66ac2c774ef9f2afb04504ffe4d5d316e524eb663e0a9b1502f8f3fb3cda5c46f1096a5c3278e948b834f168007a0d

Download Submit
C:\Users\Public\alpha.exe

Filesize
283KB

MD5
8a2122e8162dbef04694b9c3e0b6cdee

SHA1
f1efb0fddc156e4c61c5f78a54700e4e7984d55d

SHA256
b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

SHA512
99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

Download Submit
C:\Users\Public\kn.exe

Filesize
1.6MB

MD5
bd8d9943a9b1def98eb83e0fa48796c2

SHA1
70e89852f023ab7cde0173eda1208dbb580f1e4f

SHA256
8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2

SHA512
95630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b

Download Submit
C:\Users\Public\spoolsv.MPEG

Filesize
4.4MB

MD5
fb784626da657f1cc38fe53ded33b522

SHA1
0dbccd37f47d25d97fd60124ef1c7e4ab210751c

SHA256
57a7606bd8add2ea12f253b5bb0be48f4dda53490e036498d97083383db4b595

SHA512
2b788dd61ec3a1b72746015d88038465c6ca9646199a3e1cc25f48e947a42dc4944580c60550290aa80532731945baa58ba18df5b1d862922123ad1df98f0fe4

Download Submit
memory/5048-28-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/5048-30-0x0000000002C80000-0x0000000003C80000-memory.dmp

Filesize
16.0MB

Download
memory/5048-31-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download