modiloader | 8f721d0dc987c60cb16a14ad166eab606b1b9401d6563241eb8ed359c24ad201

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-01-2025 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO3_RKG367.bat
Size

2.1MB
MD5

deaa9cb6ee189b95d1ad718df32dac56
SHA1

ba94e1e97609cfa1bd102fe1087fc714875c6c25
SHA256

8f721d0dc987c60cb16a14ad166eab606b1b9401d6563241eb8ed359c24ad201
SHA512

02908f9c7ce3a1d53af14de4465744585b23d31e99e08d2a64030f60eac5da5505c93e5fe4de91aeb77b85377d57b047ed8a5d5262fd08dcffa30943b0bb88e1
SSDEEP

49152:dCPDyxXvtkfpoX/xXGkA++z8+j+Dl+T++evHN+C2+1r+E++eaU++p+++7C+z+++q:n

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 61 IoCs

resource	yara_rule
behavioral1/memory/2608-25101-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25114-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25117-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25120-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25123-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25126-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25129-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25134-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25137-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25140-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25143-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25146-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25149-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25152-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25155-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25158-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25161-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25164-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25167-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25111-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25172-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25105-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25175-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25178-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25181-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25184-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25106-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25118-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25125-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25107-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25108-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25132-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25109-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25138-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25145-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25153-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25110-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25154-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25151-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25150-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25148-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25147-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25144-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25142-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25141-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25139-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25136-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25135-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25133-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25131-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25130-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25128-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25127-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25124-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25122-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25121-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25119-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25116-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25115-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25113-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2
behavioral1/memory/2608-25112-0x0000000003450000-0x0000000004450000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
2608	x.exe

Loads dropped DLL 3 IoCs

pid	Process
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1640	2608	WerFault.exe	33

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2608	x.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2060	2124	cmd.exe	31
PID 2124 wrote to memory of 2060	2124	cmd.exe	31
PID 2124 wrote to memory of 2060	2124	cmd.exe	31
PID 2124 wrote to memory of 344	2124	cmd.exe	32
PID 2124 wrote to memory of 344	2124	cmd.exe	32
PID 2124 wrote to memory of 344	2124	cmd.exe	32
PID 2124 wrote to memory of 2608	2124	cmd.exe	33
PID 2124 wrote to memory of 2608	2124	cmd.exe	33
PID 2124 wrote to memory of 2608	2124	cmd.exe	33
PID 2124 wrote to memory of 2608	2124	cmd.exe	33
PID 2608 wrote to memory of 1640	2608	x.exe	34
PID 2608 wrote to memory of 1640	2608	x.exe	34
PID 2608 wrote to memory of 1640	2608	x.exe	34
PID 2608 wrote to memory of 1640	2608	x.exe	34

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\PO3_RKG367.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\system32\findstr.exe
  findstr /e "'v" "C:\Users\Admin\AppData\Local\Temp\PO3_RKG367.bat"
  2⤵
  PID:2060
- C:\Windows\system32\cscript.exe
  cscript //nologo C:\Users\Admin\AppData\Local\Temp\x.vbs
  2⤵
  PID:344
- C:\Users\Admin\AppData\Local\Temp\x.exe
  C:\Users\Admin\AppData\Local\Temp\x.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 712
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\x

Filesize
1.7MB

MD5
d8f15231457f0255e22b60c2d9cdacd4

SHA1
a804611c22a7211c9c7e9a684770afceab4f5e50

SHA256
7dbee10bc4091a95ffb8d063ee9369488a108f15d5e633011a094d93133071c1

SHA512
c746de769651617bad3ab210d3172b420016a5819f972ba915ad44ab3307400302486fc505c09cfca32c3a0521695b0e2f25043bc71c8c887a708a84c9c4828e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x

Filesize
3KB

MD5
b1db9efdc7d4332a1a23f5aeda7a9a3a

SHA1
df2413c844d6a6ff751b157b736d5ae66feb2b42

SHA256
1d9d7a0081cc6c7723922ce93f85a5a9de7421d696383fd0b028b8437804d20c

SHA512
b76d8255947abcdb71b69853a531bb0e3e996164f17e87df66cd9e7c5a2940b1160ece507c7cb706afbe06c923a9d3e16b78fa44b1bc0f2ada792f98c1dd3789

Download Submit
C:\Users\Admin\AppData\Local\Temp\x

Filesize
4KB

MD5
8b56d90d25ceaffc261e7e1f704591b5

SHA1
cdd89330fba5c52488b04810694b95f813bb284e

SHA256
ba0f06ef50be8920123b9b7147c909593164cfa996898e4bfc53a30db1eaabdf

SHA512
f0d4f40aa76e860b7e2341347309d1fd9932e477ceb3863d2ad07d67d6066ced94d02cbf7a8bd4bb8153bfddc0e0ffef85c0bcbdc5cb2cff77d8b3ba1b3fc9bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.exe

Filesize
1.3MB

MD5
e337ecd5680d121d6dd649956dc716ca

SHA1
198eaa7905760aa3fee7d7329ec6354096c6ba63

SHA256
80af0ddc803bb3cd14029cd9cee39d81b15b21fc126912efbdd7824ba740669b

SHA512
75783a2850f451e4733f7cfbbf1a9451041c040bb64b7df7aa19abe2fffddf45291c4706c5f606ee6ad168779b25c0d88de2481fc563dab1531bfd907cc20c92

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.vbs

Filesize
380B

MD5
ec9a2fb69a379d913a4e0a953cd3b97c

SHA1
a0303ed9f787c042071a1286bba43a5bbdd0679e

SHA256
cf8268d158bb819ef158ff6ccbed64d5e379148a0adb1f73a082a01d56d0286b

SHA512
fef8e24a680991046bd7dacd6079c7e48c3031fe46caae722ea93797ee16c052073ba97959e992ea71ac7ab72fbcedaa5cf4a410657aac4c10ad24de6935e9d6

Download Submit
memory/2608-25099-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2608-25100-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25101-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25103-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2608-25114-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25117-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25120-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25123-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25126-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25129-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25134-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25137-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25140-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25143-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25146-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25149-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25152-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25155-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25158-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25161-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25164-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25167-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25111-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25172-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25105-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25175-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25178-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25181-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25184-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25106-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25118-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25125-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25107-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25108-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25132-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25109-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25138-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25145-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25153-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25110-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25154-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25151-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25150-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25148-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25147-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25144-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25142-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25141-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25139-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25136-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25135-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25133-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25131-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25130-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25128-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25127-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25124-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25122-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25121-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25119-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25116-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25115-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25113-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download
memory/2608-25112-0x0000000003450000-0x0000000004450000-memory.dmp

Filesize
16.0MB

Download