modiloader | 8f721d0dc987c60cb16a14ad166eab606b1b9401d6563241eb8ed359c24ad201

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2025 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f721d0dc987c60cb16a14ad166eab606b1b9401d6563241eb8ed359c24ad201.bat
Size

2.1MB
MD5

deaa9cb6ee189b95d1ad718df32dac56
SHA1

ba94e1e97609cfa1bd102fe1087fc714875c6c25
SHA256

8f721d0dc987c60cb16a14ad166eab606b1b9401d6563241eb8ed359c24ad201
SHA512

02908f9c7ce3a1d53af14de4465744585b23d31e99e08d2a64030f60eac5da5505c93e5fe4de91aeb77b85377d57b047ed8a5d5262fd08dcffa30943b0bb88e1
SSDEEP

49152:dCPDyxXvtkfpoX/xXGkA++z8+j+Dl+T++evHN+C2+1r+E++eaU++p+++7C+z+++q:n

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 61 IoCs

resource	yara_rule
behavioral2/memory/2468-25102-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25108-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25128-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25161-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25158-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25163-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25166-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25165-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25164-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25162-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25160-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25159-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25157-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25155-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25154-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25153-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25152-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25151-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25149-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25150-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25148-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25146-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25145-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25144-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25143-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25139-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25138-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25137-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25136-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25135-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25134-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25130-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25129-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25126-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25156-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25125-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25124-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25147-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25123-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25122-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25142-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25121-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25141-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25140-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25119-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25118-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25133-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25117-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25132-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25131-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25116-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25115-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25127-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25114-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25113-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25112-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25120-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25111-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25110-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25109-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2
behavioral2/memory/2468-25107-0x0000000002B60000-0x0000000003B60000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
2468	x.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	36	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3496	3028	cmd.exe	95
PID 3028 wrote to memory of 3496	3028	cmd.exe	95
PID 3028 wrote to memory of 4464	3028	cmd.exe	96
PID 3028 wrote to memory of 4464	3028	cmd.exe	96
PID 3028 wrote to memory of 2468	3028	cmd.exe	97
PID 3028 wrote to memory of 2468	3028	cmd.exe	97
PID 3028 wrote to memory of 2468	3028	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\8f721d0dc987c60cb16a14ad166eab606b1b9401d6563241eb8ed359c24ad201.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\system32\findstr.exe
  findstr /e "'v" "C:\Users\Admin\AppData\Local\Temp\8f721d0dc987c60cb16a14ad166eab606b1b9401d6563241eb8ed359c24ad201.bat"
  2⤵
  PID:3496
- C:\Windows\system32\cscript.exe
  cscript //nologo C:\Users\Admin\AppData\Local\Temp\x.vbs
  2⤵
  PID:4464
- C:\Users\Admin\AppData\Local\Temp\x.exe
  C:\Users\Admin\AppData\Local\Temp\x.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\x

Filesize
1.7MB

MD5
d8f15231457f0255e22b60c2d9cdacd4

SHA1
a804611c22a7211c9c7e9a684770afceab4f5e50

SHA256
7dbee10bc4091a95ffb8d063ee9369488a108f15d5e633011a094d93133071c1

SHA512
c746de769651617bad3ab210d3172b420016a5819f972ba915ad44ab3307400302486fc505c09cfca32c3a0521695b0e2f25043bc71c8c887a708a84c9c4828e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x

Filesize
4KB

MD5
acf8bffa8dfef9653507e588de3dd9af

SHA1
1ab15a8ad3f28f20206a7bf627063a506fda44de

SHA256
f3fa80c19acea92f6ecc062a4a00affd70dde30983f1358ae881bb2de1a45951

SHA512
cf82b5278c0cb88e9104331e1b30de9abbc4e1079d724617bc36132afc0a33d191bfb0ccc1dadaa3c98040b1d292de9988da0c86af73c3aad11331199b19250f

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.exe

Filesize
1.3MB

MD5
e337ecd5680d121d6dd649956dc716ca

SHA1
198eaa7905760aa3fee7d7329ec6354096c6ba63

SHA256
80af0ddc803bb3cd14029cd9cee39d81b15b21fc126912efbdd7824ba740669b

SHA512
75783a2850f451e4733f7cfbbf1a9451041c040bb64b7df7aa19abe2fffddf45291c4706c5f606ee6ad168779b25c0d88de2481fc563dab1531bfd907cc20c92

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.vbs

Filesize
380B

MD5
ec9a2fb69a379d913a4e0a953cd3b97c

SHA1
a0303ed9f787c042071a1286bba43a5bbdd0679e

SHA256
cf8268d158bb819ef158ff6ccbed64d5e379148a0adb1f73a082a01d56d0286b

SHA512
fef8e24a680991046bd7dacd6079c7e48c3031fe46caae722ea93797ee16c052073ba97959e992ea71ac7ab72fbcedaa5cf4a410657aac4c10ad24de6935e9d6

Download Submit
memory/2468-25100-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2468-25101-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25102-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25105-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2468-25104-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2468-25108-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25128-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25161-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25158-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25163-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25166-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25165-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25164-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25162-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25160-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25159-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25157-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25155-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25154-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25153-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25152-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25151-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25149-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25150-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25148-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25146-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25145-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25144-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25143-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25139-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25138-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25137-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25136-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25135-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25134-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25130-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25129-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25126-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25156-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25125-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25124-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25147-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25123-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25122-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25142-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25121-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25141-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25140-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25119-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25118-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25133-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25117-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25132-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25131-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25116-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25115-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25127-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25114-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25113-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25112-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25120-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25111-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25110-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25109-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download
memory/2468-25107-0x0000000002B60000-0x0000000003B60000-memory.dmp

Filesize
16.0MB

Download