modiloader | 29bda570966cf934b38ff7b1613f9330709307405391ced5452bd9cc63736331

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 04:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29bda570966cf934b38ff7b1613f9330709307405391ced5452bd9cc63736331.cmd
Size

2.8MB
MD5

7afcba92a35ba26fcde12f3aba8ff7d8
SHA1

8fe8577fc2ef8866c83ab163a8655ea777e6d4f4
SHA256

29bda570966cf934b38ff7b1613f9330709307405391ced5452bd9cc63736331
SHA512

a0fdbdb93054ea71efea0dc9ecee2d68644d89e0725a3c34e0d492fd6b2b3d9f3307fbfa5386cdec1e7f452754331bf73242e9316d3d667353cc7c62bad58027
SSDEEP

24576:kH1yveXvtJNwYay5+kiD7Dm5c0B58llll8lUWtWJxM9bh+NfbTXr063u95fX7:kVyGftJ+YawbiS5BBUvzM9bh+NfnXm

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 61 IoCs

resource	yara_rule
behavioral2/memory/1180-29-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-33-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-36-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-35-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-41-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-48-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-63-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-104-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-77-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-103-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-76-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-99-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-98-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-73-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-72-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-96-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-95-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-71-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-93-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-69-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-91-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-90-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-67-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-86-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-64-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-62-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-61-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-58-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-101-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-57-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-74-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-55-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-94-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-54-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-70-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-92-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-52-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-51-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-68-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-66-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-49-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-65-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-85-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-83-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-47-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-46-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-60-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-59-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-45-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-75-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-56-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-44-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-53-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-43-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-50-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-42-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-40-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-39-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-38-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-37-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2
behavioral2/memory/1180-34-0x0000000002A00000-0x0000000003A00000-memory.dmp	modiloader_stage2

Executes dropped EXE 8 IoCs

pid	Process
4052	alpha.exe
2716	alpha.exe
2736	kn.exe
3976	alpha.exe
3752	kn.exe
1180	spoolsv.COM
1392	alpha.exe
2428	alpha.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.COM

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	20	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 3176	4692	cmd.exe	83
PID 4692 wrote to memory of 3176	4692	cmd.exe	83
PID 4692 wrote to memory of 4052	4692	cmd.exe	84
PID 4692 wrote to memory of 4052	4692	cmd.exe	84
PID 4052 wrote to memory of 2076	4052	alpha.exe	85
PID 4052 wrote to memory of 2076	4052	alpha.exe	85
PID 4692 wrote to memory of 2716	4692	cmd.exe	86
PID 4692 wrote to memory of 2716	4692	cmd.exe	86
PID 2716 wrote to memory of 2736	2716	alpha.exe	87
PID 2716 wrote to memory of 2736	2716	alpha.exe	87
PID 4692 wrote to memory of 3976	4692	cmd.exe	88
PID 4692 wrote to memory of 3976	4692	cmd.exe	88
PID 3976 wrote to memory of 3752	3976	alpha.exe	89
PID 3976 wrote to memory of 3752	3976	alpha.exe	89
PID 4692 wrote to memory of 1180	4692	cmd.exe	90
PID 4692 wrote to memory of 1180	4692	cmd.exe	90
PID 4692 wrote to memory of 1180	4692	cmd.exe	90
PID 4692 wrote to memory of 1392	4692	cmd.exe	91
PID 4692 wrote to memory of 1392	4692	cmd.exe	91
PID 4692 wrote to memory of 2428	4692	cmd.exe	92
PID 4692 wrote to memory of 2428	4692	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\29bda570966cf934b38ff7b1613f9330709307405391ced5452bd9cc63736331.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\System32\extrac32.exe
  C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
  2⤵
  PID:3176
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\system32\extrac32.exe
    extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
    3⤵
    PID:2076
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\29bda570966cf934b38ff7b1613f9330709307405391ced5452bd9cc63736331.cmd" "C:\\Users\\Public\\spoolsv.MPEG" 9
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Public\kn.exe
    C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\29bda570966cf934b38ff7b1613f9330709307405391ced5452bd9cc63736331.cmd" "C:\\Users\\Public\\spoolsv.MPEG" 9
    3⤵
    - Executes dropped EXE
    PID:2736
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\spoolsv.MPEG" "C:\\Users\\Public\\Libraries\\spoolsv.COM" 12
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Users\Public\kn.exe
    C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\spoolsv.MPEG" "C:\\Users\\Public\\Libraries\\spoolsv.COM" 12
    3⤵
    - Executes dropped EXE
    PID:3752
- C:\Users\Public\Libraries\spoolsv.COM
  C:\Users\Public\Libraries\spoolsv.COM
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1180
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Users\Public\alpha.exe
  C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\spoolsv.MPEG" / A / F / Q / S
  2⤵
  - Executes dropped EXE
  PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Libraries\spoolsv.COM

Filesize
995KB

MD5
dfd15a4158ab979660435d6f3e95a3ec

SHA1
6d5566cddfb4b99e82a6babdbd4536a24e8f6f73

SHA256
baa12b649fddd77ef62ecd2b3169fab9bb5fbe78404175485f9a7fb48dc4456d

SHA512
f33677b419f307c8970c0024e45162bc83e63141878ec2d15b59011261cb30aa412076b62b80fd4e9b99713a689c10699ea8682f67754b2569c83b22b1225e02

Download Submit
C:\Users\Public\alpha.exe

Filesize
283KB

MD5
8a2122e8162dbef04694b9c3e0b6cdee

SHA1
f1efb0fddc156e4c61c5f78a54700e4e7984d55d

SHA256
b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

SHA512
99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

Download Submit
C:\Users\Public\kn.exe

Filesize
1.6MB

MD5
bd8d9943a9b1def98eb83e0fa48796c2

SHA1
70e89852f023ab7cde0173eda1208dbb580f1e4f

SHA256
8de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2

SHA512
95630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b

Download Submit
C:\Users\Public\spoolsv.MPEG

Filesize
1.9MB

MD5
eb3c4dd5b03eb7e43016cb693c1c6820

SHA1
8c3cbf8733a1642c43bb7847ccbf0338b931fb64

SHA256
ad93393e701dc0ebf905589e548ffa4a1bb894c34e70f8ee730e3fdf34158779

SHA512
0331dadcfcc4f06a38bb68c08ff1c3c60f009ccd57c3ff4c60e49090667d541d342e9dd6b01d989dcde1091eaa21f142ed3d5a292970abdfa58b8818fec97a45

Download Submit
memory/1180-28-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-29-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-31-0x0000000000400000-0x0000000000502000-memory.dmp

Filesize
1.0MB

Download
memory/1180-33-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-36-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-35-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-41-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-48-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-63-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-104-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-77-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-103-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-76-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-99-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-98-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-73-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-72-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-96-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-95-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-71-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-93-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-69-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-91-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-90-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-67-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-86-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-64-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-62-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-61-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-58-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-101-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-57-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-74-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-55-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-94-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-54-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-70-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-92-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-52-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-51-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-68-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-66-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-49-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-65-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-85-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-83-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-47-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-46-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-60-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-59-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-45-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-75-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-56-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-44-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-53-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-43-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-50-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-42-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-40-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-39-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-38-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-37-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download
memory/1180-34-0x0000000002A00000-0x0000000003A00000-memory.dmp

Filesize
16.0MB

Download