modiloader | 3aae124eceda655dd6298323abad2fd571cdf580a22ba11921c2d0b45038f406

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23-10-2024 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Krcdanwiedyoqk.exe
Size

1.1MB
MD5

da449c2d60fe9adb096242dd71db10c8
SHA1

55276aa1b212c91e997d70deac1595528234fc96
SHA256

57a211664560494ee01af527f281a3fcc9727c15c322122d283e5213a11ab3d3
SHA512

1c20999f7295b4c38af4c48dfe34b6738522028a984e0df1f9375212700f6297c69c4e154352b90fd0dce30bda07a54d155a76c9475acd35e7962eba6b458b34
SSDEEP

24576:rCtVqnbUQ25Qm2XzuiYcx3RqrPBzKRfuHpEqiyu5T5:rkabmuYc3qrWyuv

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 61 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1700-2-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-8-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-17-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-16-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-15-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-19-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-14-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-13-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-22-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-12-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-11-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-24-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-10-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-28-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-7-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-6-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-30-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-34-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-38-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-41-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-45-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-48-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-52-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-54-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-58-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-60-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-62-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-65-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-9-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-50-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-64-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-63-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-61-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-59-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-57-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-56-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-55-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-53-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-51-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-49-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-47-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-46-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-44-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-43-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-42-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-40-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-39-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-37-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-36-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-35-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-33-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-32-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-31-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-29-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-27-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-26-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-25-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-23-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-21-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-20-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-18-0x0000000003290000-0x0000000004290000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

740 1700 WerFault.exe Krcdanwiedyoqk.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

Krcdanwiedyoqk.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Krcdanwiedyoqk.exe

pid	pid_target	process	target process
740	1700	WerFault.exe	Krcdanwiedyoqk.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Krcdanwiedyoqk.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Krcdanwiedyoqk.exe

description	pid	process	target process
PID 1700 wrote to memory of 740	1700	Krcdanwiedyoqk.exe	WerFault.exe
PID 1700 wrote to memory of 740	1700	Krcdanwiedyoqk.exe	WerFault.exe
PID 1700 wrote to memory of 740	1700	Krcdanwiedyoqk.exe	WerFault.exe
PID 1700 wrote to memory of 740	1700	Krcdanwiedyoqk.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Krcdanwiedyoqk.exe
"C:\Users\Admin\AppData\Local\Temp\Krcdanwiedyoqk.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 696
  2⤵
  - Program crash
  PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1700-2-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-1-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-4-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/1700-8-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-17-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-16-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-15-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-19-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-14-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-13-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-22-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-12-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-11-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-24-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-10-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-28-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-7-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-6-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-30-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-34-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-38-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-41-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-45-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-48-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-52-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-54-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-58-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-60-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-62-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-65-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-9-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-50-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-64-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-63-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-61-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-59-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-57-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-56-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-55-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-53-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-51-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-49-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-47-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-46-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-44-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-43-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-42-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-40-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-39-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-37-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-36-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-35-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-33-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-32-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-31-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-29-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-27-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-26-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-25-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-23-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-21-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-20-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download
memory/1700-18-0x0000000003290000-0x0000000004290000-memory.dmp

Filesize
16.0MB

Download