modiloader | e66a156bc6d1ef4b56a572c4133de2559388152dc36d1f35860e2defa566caaa

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
31/12/2024, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

P1_2024_056209_MQ04865_ENQ_1045.cmd
Size

2.1MB
MD5

e74e6f735a0aabae7ea551ec00081be9
SHA1

e21c6050c4b5598be0db7fff9abefdfcb8a78f04
SHA256

e66a156bc6d1ef4b56a572c4133de2559388152dc36d1f35860e2defa566caaa
SHA512

e26c43246087b24b40642f7fb412210a0cce295ce3009136d08596bcc644f74f4734e7f1375f2117d89a8935636d002d7b6c3065cd9aa2380a50c96d54c093c0
SSDEEP

49152:W/UYHg0ZTx0dUH7eZArfNZ+k+lT+n++a++m+oj7+h+VLV++l++NGv++Ts+++ga+R:6

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 61 IoCs

resource	yara_rule
behavioral1/memory/1472-25999-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26028-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26080-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26078-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26048-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26046-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26045-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26043-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26041-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26038-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26035-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26033-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26031-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26029-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26027-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26026-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26025-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26023-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26022-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26020-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26017-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26019-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26016-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26014-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26013-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26011-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26082-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26010-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26075-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26072-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26070-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26068-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26066-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26009-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26064-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26061-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26059-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26057-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26008-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26054-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26051-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26049-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26047-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26044-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26042-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26040-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26039-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26037-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26036-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26007-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26034-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26032-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26030-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26006-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26005-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26004-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26024-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26021-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26018-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26015-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2
behavioral1/memory/1472-26012-0x00000000033E0000-0x00000000043E0000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
1472	x.exe

Loads dropped DLL 3 IoCs

pid	Process
1300	WerFault.exe
1300	WerFault.exe
1300	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1300	1472	WerFault.exe	34

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1472	x.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2984	2952	cmd.exe	32
PID 2952 wrote to memory of 2984	2952	cmd.exe	32
PID 2952 wrote to memory of 2984	2952	cmd.exe	32
PID 2952 wrote to memory of 2216	2952	cmd.exe	33
PID 2952 wrote to memory of 2216	2952	cmd.exe	33
PID 2952 wrote to memory of 2216	2952	cmd.exe	33
PID 2952 wrote to memory of 1472	2952	cmd.exe	34
PID 2952 wrote to memory of 1472	2952	cmd.exe	34
PID 2952 wrote to memory of 1472	2952	cmd.exe	34
PID 2952 wrote to memory of 1472	2952	cmd.exe	34
PID 1472 wrote to memory of 1300	1472	x.exe	35
PID 1472 wrote to memory of 1300	1472	x.exe	35
PID 1472 wrote to memory of 1300	1472	x.exe	35
PID 1472 wrote to memory of 1300	1472	x.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\P1_2024_056209_MQ04865_ENQ_1045.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\system32\findstr.exe
  findstr /e "'v" "C:\Users\Admin\AppData\Local\Temp\P1_2024_056209_MQ04865_ENQ_1045.cmd"
  2⤵
  PID:2984
- C:\Windows\system32\cscript.exe
  cscript //nologo C:\Users\Admin\AppData\Local\Temp\x.vbs
  2⤵
  PID:2216
- C:\Users\Admin\AppData\Local\Temp\x.exe
  C:\Users\Admin\AppData\Local\Temp\x.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 720
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\x

Filesize
1.8MB

MD5
bf38536008977969fa57ff4fca96af75

SHA1
1ff7c41ce6d80f772f6fa32e667285587ee21cbd

SHA256
5171548d61d342b89a92969bb13e4431ea8acd46a7146f448ebdb49639f19e9f

SHA512
f14c7a41d2e1b40b735071648db81d8cac2e5180a2062351365109ce384bcb317d7bc7ecbfb416d7614c1cdcae8c29180f937585e87b6ef43bcca8bbbe4046f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\x

Filesize
576B

MD5
ff129a0422ec3ad5879d8dc9382b5445

SHA1
e0f82a9285bfea69977be4833ef3ff0f5d00aea7

SHA256
de0c8750fe2846c26d85c2ff4f68164a1ec021e0b351b402ec74cb10550c1e80

SHA512
e498f794c005b0c29a7d353984fcf1aafaf4c2cfe25c01b39a527867181745ce394749f2787ff31ceffb0d250f49c3dedd4d69a822836cfc4d7ebd31cbad674a

Download Submit
C:\Users\Admin\AppData\Local\Temp\x

Filesize
4KB

MD5
a3aecfbaa811e50bc13de5d114f63d3c

SHA1
4a97cb37fabecfb8b42f82ede45b0166cba929a8

SHA256
d0a93634d9d12cecb2096bf67ff5a89a7924c4da80b37cc96a3f5fdb62e1d478

SHA512
b57309945c0b621c1164bb8890193681b717a674ff1568b6e3958b1ce7cf13e202b8a12e196a543c7db82a6fd3ffb394543652fe322dbf71a22a4eaf98320afe

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.exe

Filesize
1.3MB

MD5
d1f6b3bd433945255249291310f2e59e

SHA1
b5a2b9ec979e17c4d1074e7d1a23b550cce578d5

SHA256
7886e0dcb78a5d5e67f9d28272c24a29139accf9ff7616b659ffeb3eeaf1603a

SHA512
116e88e5e5b4db7086d5efe759a3b7883ded9cd691327e3f71aee61f0920805a21118d801231b7c091c4ee8e7beca6f5efadd577031336775bc93f2bcbec2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.vbs

Filesize
380B

MD5
ec9a2fb69a379d913a4e0a953cd3b97c

SHA1
a0303ed9f787c042071a1286bba43a5bbdd0679e

SHA256
cf8268d158bb819ef158ff6ccbed64d5e379148a0adb1f73a082a01d56d0286b

SHA512
fef8e24a680991046bd7dacd6079c7e48c3031fe46caae722ea93797ee16c052073ba97959e992ea71ac7ab72fbcedaa5cf4a410657aac4c10ad24de6935e9d6

Download Submit
memory/1472-25997-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1472-25999-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-25998-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26002-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1472-26001-0x0000000000400000-0x0000000000556000-memory.dmp

Filesize
1.3MB

Download
memory/1472-26028-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26080-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26078-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26048-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26046-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26045-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26043-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26041-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26038-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26035-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26033-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26031-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26029-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26027-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26026-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26025-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26023-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26022-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26020-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26017-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26019-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26016-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26014-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26013-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26011-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26082-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26010-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26075-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26072-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26070-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26068-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26066-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26009-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26064-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26061-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26059-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26057-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26008-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26054-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26051-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26049-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26047-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26044-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26042-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26040-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26039-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26037-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26036-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26007-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26034-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26032-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26030-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26006-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26005-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26004-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26024-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26021-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26018-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26015-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download
memory/1472-26012-0x00000000033E0000-0x00000000043E0000-memory.dmp

Filesize
16.0MB

Download