modiloader | 8f721d0dc987c60cb16a14ad166eab606b1b9401d6563241eb8ed359c24ad201

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-01-2025 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f721d0dc987c60cb16a14ad166eab606b1b9401d6563241eb8ed359c24ad201.bat
Size

2.1MB
MD5

deaa9cb6ee189b95d1ad718df32dac56
SHA1

ba94e1e97609cfa1bd102fe1087fc714875c6c25
SHA256

8f721d0dc987c60cb16a14ad166eab606b1b9401d6563241eb8ed359c24ad201
SHA512

02908f9c7ce3a1d53af14de4465744585b23d31e99e08d2a64030f60eac5da5505c93e5fe4de91aeb77b85377d57b047ed8a5d5262fd08dcffa30943b0bb88e1
SSDEEP

49152:dCPDyxXvtkfpoX/xXGkA++z8+j+Dl+T++evHN+C2+1r+E++eaU++p+++7C+z+++q:n

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 61 IoCs

resource	yara_rule
behavioral1/memory/2932-25101-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25180-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25112-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25154-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25153-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25151-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25150-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25148-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25147-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25145-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25142-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25141-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25139-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25138-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25136-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25134-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25131-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25128-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25127-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25125-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25124-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25121-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25120-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25118-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25117-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25115-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25114-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25111-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25156-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25109-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25144-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25137-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25108-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25133-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25132-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25130-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25107-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25123-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25106-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25184-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25105-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25177-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25173-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25170-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25167-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25163-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25110-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25159-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25155-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25152-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25149-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25146-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25143-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25140-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25135-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25129-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25126-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25122-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25119-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25116-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2
behavioral1/memory/2932-25113-0x0000000003590000-0x0000000004590000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
2932	x.exe

Loads dropped DLL 3 IoCs

pid	Process
1348	WerFault.exe
1348	WerFault.exe
1348	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1348	2932	WerFault.exe	34

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2932	x.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2624	2132	cmd.exe	32
PID 2132 wrote to memory of 2624	2132	cmd.exe	32
PID 2132 wrote to memory of 2624	2132	cmd.exe	32
PID 2132 wrote to memory of 2956	2132	cmd.exe	33
PID 2132 wrote to memory of 2956	2132	cmd.exe	33
PID 2132 wrote to memory of 2956	2132	cmd.exe	33
PID 2132 wrote to memory of 2932	2132	cmd.exe	34
PID 2132 wrote to memory of 2932	2132	cmd.exe	34
PID 2132 wrote to memory of 2932	2132	cmd.exe	34
PID 2132 wrote to memory of 2932	2132	cmd.exe	34
PID 2932 wrote to memory of 1348	2932	x.exe	35
PID 2932 wrote to memory of 1348	2932	x.exe	35
PID 2932 wrote to memory of 1348	2932	x.exe	35
PID 2932 wrote to memory of 1348	2932	x.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\8f721d0dc987c60cb16a14ad166eab606b1b9401d6563241eb8ed359c24ad201.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\system32\findstr.exe
  findstr /e "'v" "C:\Users\Admin\AppData\Local\Temp\8f721d0dc987c60cb16a14ad166eab606b1b9401d6563241eb8ed359c24ad201.bat"
  2⤵
  PID:2624
- C:\Windows\system32\cscript.exe
  cscript //nologo C:\Users\Admin\AppData\Local\Temp\x.vbs
  2⤵
  PID:2956
- C:\Users\Admin\AppData\Local\Temp\x.exe
  C:\Users\Admin\AppData\Local\Temp\x.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 712
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\x

Filesize
1.7MB

MD5
d8f15231457f0255e22b60c2d9cdacd4

SHA1
a804611c22a7211c9c7e9a684770afceab4f5e50

SHA256
7dbee10bc4091a95ffb8d063ee9369488a108f15d5e633011a094d93133071c1

SHA512
c746de769651617bad3ab210d3172b420016a5819f972ba915ad44ab3307400302486fc505c09cfca32c3a0521695b0e2f25043bc71c8c887a708a84c9c4828e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x

Filesize
864B

MD5
57c5ebb63f1c8e44a1055fc9cd16199c

SHA1
21e24bdeddce465c2c837bac6d9fc403afe0f06a

SHA256
92e12110f5964d53d0e09d9587835036d6a78338b77ae0e6e7facdf732f67df8

SHA512
c44fe2571fb962e7a0837c639955668398f00a8be58e059978fc918a02abcecfd04f08a948e48ac5992034d02850c098b5e0798acd93de3e3f3b26028f96e7c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\x

Filesize
4KB

MD5
acf8bffa8dfef9653507e588de3dd9af

SHA1
1ab15a8ad3f28f20206a7bf627063a506fda44de

SHA256
f3fa80c19acea92f6ecc062a4a00affd70dde30983f1358ae881bb2de1a45951

SHA512
cf82b5278c0cb88e9104331e1b30de9abbc4e1079d724617bc36132afc0a33d191bfb0ccc1dadaa3c98040b1d292de9988da0c86af73c3aad11331199b19250f

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.exe

Filesize
1.3MB

MD5
e337ecd5680d121d6dd649956dc716ca

SHA1
198eaa7905760aa3fee7d7329ec6354096c6ba63

SHA256
80af0ddc803bb3cd14029cd9cee39d81b15b21fc126912efbdd7824ba740669b

SHA512
75783a2850f451e4733f7cfbbf1a9451041c040bb64b7df7aa19abe2fffddf45291c4706c5f606ee6ad168779b25c0d88de2481fc563dab1531bfd907cc20c92

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.vbs

Filesize
380B

MD5
ec9a2fb69a379d913a4e0a953cd3b97c

SHA1
a0303ed9f787c042071a1286bba43a5bbdd0679e

SHA256
cf8268d158bb819ef158ff6ccbed64d5e379148a0adb1f73a082a01d56d0286b

SHA512
fef8e24a680991046bd7dacd6079c7e48c3031fe46caae722ea93797ee16c052073ba97959e992ea71ac7ab72fbcedaa5cf4a410657aac4c10ad24de6935e9d6

Download Submit
memory/2932-25099-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2932-25100-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25101-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25103-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2932-25180-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25112-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25154-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25153-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25151-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25150-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25148-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25147-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25145-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25142-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25141-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25139-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25138-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25136-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25134-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25131-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25128-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25127-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25125-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25124-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25121-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25120-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25118-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25117-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25115-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25114-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25111-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25156-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25109-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25144-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25137-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25108-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25133-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25132-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25130-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25107-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25123-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25106-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25184-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25105-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25177-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25173-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25170-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25167-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25163-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25110-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25159-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25155-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25152-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25149-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25146-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25143-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25140-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25135-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25129-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25126-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25122-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25119-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25116-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download
memory/2932-25113-0x0000000003590000-0x0000000004590000-memory.dmp

Filesize
16.0MB

Download