modiloader | 34b64b3bef995a063b8b8aa863d8f4ef476f0a260ae15b124f03cc2680f79d46

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-12-2024 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO#3_RKG367.bat
Size

2.1MB
MD5

deaa9cb6ee189b95d1ad718df32dac56
SHA1

ba94e1e97609cfa1bd102fe1087fc714875c6c25
SHA256

8f721d0dc987c60cb16a14ad166eab606b1b9401d6563241eb8ed359c24ad201
SHA512

02908f9c7ce3a1d53af14de4465744585b23d31e99e08d2a64030f60eac5da5505c93e5fe4de91aeb77b85377d57b047ed8a5d5262fd08dcffa30943b0bb88e1
SSDEEP

49152:dCPDyxXvtkfpoX/xXGkA++z8+j+Dl+T++evHN+C2+1r+E++eaU++p+++7C+z+++q:n

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 61 IoCs

resource	yara_rule
behavioral1/memory/1412-25101-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25114-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25179-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25146-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25145-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25143-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25140-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25138-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25137-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25134-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25132-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25131-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25129-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25126-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25125-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25123-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25121-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25120-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25117-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25116-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25115-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25182-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25180-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25176-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25174-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25172-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25113-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25169-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25167-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25164-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25162-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25160-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25159-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25156-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25154-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25152-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25150-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25148-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25147-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25144-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25142-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25141-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25139-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25136-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25135-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25133-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25130-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25128-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25127-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25124-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25122-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25106-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25119-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25118-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25105-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25112-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25111-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25110-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25109-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25108-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2
behavioral1/memory/1412-25107-0x0000000003410000-0x0000000004410000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
1412	x.exe

Loads dropped DLL 3 IoCs

pid	Process
896	WerFault.exe
896	WerFault.exe
896	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
896	1412	WerFault.exe	34

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1412	x.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 584	1904	cmd.exe	32
PID 1904 wrote to memory of 584	1904	cmd.exe	32
PID 1904 wrote to memory of 584	1904	cmd.exe	32
PID 1904 wrote to memory of 1796	1904	cmd.exe	33
PID 1904 wrote to memory of 1796	1904	cmd.exe	33
PID 1904 wrote to memory of 1796	1904	cmd.exe	33
PID 1904 wrote to memory of 1412	1904	cmd.exe	34
PID 1904 wrote to memory of 1412	1904	cmd.exe	34
PID 1904 wrote to memory of 1412	1904	cmd.exe	34
PID 1904 wrote to memory of 1412	1904	cmd.exe	34
PID 1412 wrote to memory of 896	1412	x.exe	35
PID 1412 wrote to memory of 896	1412	x.exe	35
PID 1412 wrote to memory of 896	1412	x.exe	35
PID 1412 wrote to memory of 896	1412	x.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\PO#3_RKG367.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\system32\findstr.exe
  findstr /e "'v" "C:\Users\Admin\AppData\Local\Temp\PO#3_RKG367.bat"
  2⤵
  PID:584
- C:\Windows\system32\cscript.exe
  cscript //nologo C:\Users\Admin\AppData\Local\Temp\x.vbs
  2⤵
  PID:1796
- C:\Users\Admin\AppData\Local\Temp\x.exe
  C:\Users\Admin\AppData\Local\Temp\x.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 696
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\x

Filesize
1.7MB

MD5
d8f15231457f0255e22b60c2d9cdacd4

SHA1
a804611c22a7211c9c7e9a684770afceab4f5e50

SHA256
7dbee10bc4091a95ffb8d063ee9369488a108f15d5e633011a094d93133071c1

SHA512
c746de769651617bad3ab210d3172b420016a5819f972ba915ad44ab3307400302486fc505c09cfca32c3a0521695b0e2f25043bc71c8c887a708a84c9c4828e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x

Filesize
4KB

MD5
3bbebf9c53baeda54ad250eda5984f4a

SHA1
488e9e110c18bbb0128b77a217e4f4ebedd3b7b8

SHA256
6734cfc7399967a4a98ec4b2701452ea9b59379c31cf1cf65e93c1f24941eb3b

SHA512
de4fc66b1065fa38db1c807eb7742b6580fc9e80b78db0a477ac546e2cad76f3fb340b15b585f717e37d509302315d0ce1b7f304919825b03d974713a186706e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.exe

Filesize
1.3MB

MD5
e337ecd5680d121d6dd649956dc716ca

SHA1
198eaa7905760aa3fee7d7329ec6354096c6ba63

SHA256
80af0ddc803bb3cd14029cd9cee39d81b15b21fc126912efbdd7824ba740669b

SHA512
75783a2850f451e4733f7cfbbf1a9451041c040bb64b7df7aa19abe2fffddf45291c4706c5f606ee6ad168779b25c0d88de2481fc563dab1531bfd907cc20c92

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.vbs

Filesize
380B

MD5
ec9a2fb69a379d913a4e0a953cd3b97c

SHA1
a0303ed9f787c042071a1286bba43a5bbdd0679e

SHA256
cf8268d158bb819ef158ff6ccbed64d5e379148a0adb1f73a082a01d56d0286b

SHA512
fef8e24a680991046bd7dacd6079c7e48c3031fe46caae722ea93797ee16c052073ba97959e992ea71ac7ab72fbcedaa5cf4a410657aac4c10ad24de6935e9d6

Download Submit
memory/1412-25099-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1412-25101-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25100-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25103-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/1412-25114-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25179-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25146-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25145-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25143-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25140-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25138-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25137-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25134-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25132-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25131-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25129-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25126-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25125-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25123-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25121-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25120-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25117-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25116-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25115-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25182-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25180-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25176-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25174-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25172-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25113-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25169-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25167-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25164-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25162-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25160-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25159-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25156-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25154-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25152-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25150-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25148-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25147-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25144-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25142-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25141-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25139-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25136-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25135-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25133-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25130-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25128-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25127-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25124-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25122-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25106-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25119-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25118-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25105-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25112-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25111-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25110-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25109-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25108-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download
memory/1412-25107-0x0000000003410000-0x0000000004410000-memory.dmp

Filesize
16.0MB

Download