modiloader | 8f721d0dc987c60cb16a14ad166eab606b1b9401d6563241eb8ed359c24ad201

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
09-01-2025 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO#3_RKG367.bat
Size

2.1MB
MD5

deaa9cb6ee189b95d1ad718df32dac56
SHA1

ba94e1e97609cfa1bd102fe1087fc714875c6c25
SHA256

8f721d0dc987c60cb16a14ad166eab606b1b9401d6563241eb8ed359c24ad201
SHA512

02908f9c7ce3a1d53af14de4465744585b23d31e99e08d2a64030f60eac5da5505c93e5fe4de91aeb77b85377d57b047ed8a5d5262fd08dcffa30943b0bb88e1
SSDEEP

49152:dCPDyxXvtkfpoX/xXGkA++z8+j+Dl+T++evHN+C2+1r+E++eaU++p+++7C+z+++q:n

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 61 IoCs

resource	yara_rule
behavioral1/memory/2824-25101-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25129-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25108-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25134-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25149-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25145-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25144-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25142-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25140-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25139-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25137-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25133-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25131-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25128-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25130-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25127-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25125-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25124-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25122-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25121-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25120-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25117-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25119-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25114-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25116-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25184-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25113-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25181-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25179-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25177-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25175-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25112-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25172-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25170-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25169-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25166-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25164-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25162-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25159-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25157-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25155-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25111-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25153-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25150-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25148-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25146-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25109-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25143-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25141-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25138-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25136-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25135-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25132-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25107-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25105-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25126-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25123-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25106-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25118-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25115-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2
behavioral1/memory/2824-25110-0x00000000033C0000-0x00000000043C0000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
2824	x.exe

Loads dropped DLL 3 IoCs

pid	Process
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	2824	WerFault.exe	34

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2824	x.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2540	1976	cmd.exe	32
PID 1976 wrote to memory of 2540	1976	cmd.exe	32
PID 1976 wrote to memory of 2540	1976	cmd.exe	32
PID 1976 wrote to memory of 2956	1976	cmd.exe	33
PID 1976 wrote to memory of 2956	1976	cmd.exe	33
PID 1976 wrote to memory of 2956	1976	cmd.exe	33
PID 1976 wrote to memory of 2824	1976	cmd.exe	34
PID 1976 wrote to memory of 2824	1976	cmd.exe	34
PID 1976 wrote to memory of 2824	1976	cmd.exe	34
PID 1976 wrote to memory of 2824	1976	cmd.exe	34
PID 2824 wrote to memory of 2064	2824	x.exe	35
PID 2824 wrote to memory of 2064	2824	x.exe	35
PID 2824 wrote to memory of 2064	2824	x.exe	35
PID 2824 wrote to memory of 2064	2824	x.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\PO#3_RKG367.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\system32\findstr.exe
  findstr /e "'v" "C:\Users\Admin\AppData\Local\Temp\PO#3_RKG367.bat"
  2⤵
  PID:2540
- C:\Windows\system32\cscript.exe
  cscript //nologo C:\Users\Admin\AppData\Local\Temp\x.vbs
  2⤵
  PID:2956
- C:\Users\Admin\AppData\Local\Temp\x.exe
  C:\Users\Admin\AppData\Local\Temp\x.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 680
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\x

Filesize
1.7MB

MD5
d8f15231457f0255e22b60c2d9cdacd4

SHA1
a804611c22a7211c9c7e9a684770afceab4f5e50

SHA256
7dbee10bc4091a95ffb8d063ee9369488a108f15d5e633011a094d93133071c1

SHA512
c746de769651617bad3ab210d3172b420016a5819f972ba915ad44ab3307400302486fc505c09cfca32c3a0521695b0e2f25043bc71c8c887a708a84c9c4828e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x

Filesize
1008B

MD5
68273e36092d2fd9377d09cbe93ec370

SHA1
fe99c623342b8eefeb61ed626e20df4c9acd808e

SHA256
c47ca24fb4dbf61630ec9515873015d63d504c31679fbe08b8db5df154d0ef73

SHA512
3ac0c8484915047786ffec920e7e8fec51a01e155972aef8218e3dd7691d41134d726e4cef94ffc73b2821e99ffe575352e24d57061ec8a3a2a6fd05759154a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\x

Filesize
4KB

MD5
acf8bffa8dfef9653507e588de3dd9af

SHA1
1ab15a8ad3f28f20206a7bf627063a506fda44de

SHA256
f3fa80c19acea92f6ecc062a4a00affd70dde30983f1358ae881bb2de1a45951

SHA512
cf82b5278c0cb88e9104331e1b30de9abbc4e1079d724617bc36132afc0a33d191bfb0ccc1dadaa3c98040b1d292de9988da0c86af73c3aad11331199b19250f

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.exe

Filesize
1.3MB

MD5
e337ecd5680d121d6dd649956dc716ca

SHA1
198eaa7905760aa3fee7d7329ec6354096c6ba63

SHA256
80af0ddc803bb3cd14029cd9cee39d81b15b21fc126912efbdd7824ba740669b

SHA512
75783a2850f451e4733f7cfbbf1a9451041c040bb64b7df7aa19abe2fffddf45291c4706c5f606ee6ad168779b25c0d88de2481fc563dab1531bfd907cc20c92

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.vbs

Filesize
380B

MD5
ec9a2fb69a379d913a4e0a953cd3b97c

SHA1
a0303ed9f787c042071a1286bba43a5bbdd0679e

SHA256
cf8268d158bb819ef158ff6ccbed64d5e379148a0adb1f73a082a01d56d0286b

SHA512
fef8e24a680991046bd7dacd6079c7e48c3031fe46caae722ea93797ee16c052073ba97959e992ea71ac7ab72fbcedaa5cf4a410657aac4c10ad24de6935e9d6

Download Submit
memory/2824-25099-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2824-25100-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25101-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25103-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2824-25129-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25108-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25134-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25149-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25145-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25144-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25142-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25140-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25139-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25137-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25133-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25131-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25128-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25130-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25127-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25125-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25124-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25122-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25121-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25120-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25117-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25119-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25114-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25116-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25184-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25113-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25181-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25179-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25177-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25175-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25112-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25172-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25170-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25169-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25166-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25164-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25162-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25159-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25157-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25155-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25111-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25153-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25150-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25148-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25146-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25109-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25143-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25141-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25138-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25136-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25135-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25132-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25107-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25105-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25126-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25123-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25106-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25118-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25115-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download
memory/2824-25110-0x00000000033C0000-0x00000000043C0000-memory.dmp

Filesize
16.0MB

Download