modiloader | c5bca7a3116441ecd35079c150777c1ed03494d875ac1644db2d6cbe7fe330d8

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-01-2025 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

January-16-Reminder-2025.js
Size

1.2MB
MD5

9981eb30689ed50fb6d83b3df9a4bf73
SHA1

aab7a42a0fe9cf3917edc001d2a106335c1b31d3
SHA256

c5bca7a3116441ecd35079c150777c1ed03494d875ac1644db2d6cbe7fe330d8
SHA512

fbe38f4785c234fa77f79ac740fb72620bc5be90d59551feb90d27f1424bad8cd4e0f033197d72c5761292df35a1c48dd61edc283f21d57e8880f26171d69fe2
SSDEEP

24576:BhHitPIlN14h1EWUPoNfkljva8wkIvmdHJGHpT86b0avp4kJL7a5ZKCmjLpvm:oR1lUPompvCSdvkw5w8

Score

10^/10

modiloader discovery execution trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 61 IoCs

resource	yara_rule
behavioral1/memory/760-9-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-14-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-15-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-16-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-18-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-13-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-22-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-24-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-27-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-29-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-30-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-34-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-36-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-39-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-41-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-44-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-43-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-47-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-51-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-52-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-55-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-53-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-49-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-38-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-17-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-57-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-63-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-60-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-32-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-67-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-65-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-71-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-69-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-73-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-76-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-19-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-78-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-80-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-82-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-84-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-87-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-89-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-20-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-92-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-42-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-54-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-50-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-48-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-46-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-45-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-40-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-37-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-35-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-33-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-31-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-28-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-26-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-25-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-23-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-93-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2
behavioral1/memory/760-21-0x00000000032A0000-0x00000000042A0000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
760	x.exe

Loads dropped DLL 3 IoCs

pid	Process
2932	WerFault.exe
2932	WerFault.exe
2932	WerFault.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2932	760	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 760	1720	wscript.exe	30
PID 1720 wrote to memory of 760	1720	wscript.exe	30
PID 1720 wrote to memory of 760	1720	wscript.exe	30
PID 1720 wrote to memory of 760	1720	wscript.exe	30
PID 760 wrote to memory of 2932	760	x.exe	32
PID 760 wrote to memory of 2932	760	x.exe	32
PID 760 wrote to memory of 2932	760	x.exe	32
PID 760 wrote to memory of 2932	760	x.exe	32

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\January-16-Reminder-2025.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 736
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\x.exe

Filesize
936KB

MD5
d424db9928a204dde46947ca09a8c4cd

SHA1
0cadc446d07ac332182d0bf1a592a66b7f886931

SHA256
d95889b63e296ee81026480507a4c45eb003c27de91e515fc6053a573dc998a0

SHA512
d11507e9eb3a7f4e777484c87d4823bd280744a524e1a805b574e19c6d82c971b06b6ef920620c6b1c7df6aa5c3e37b609c76eb5b6fb7c31eec23560bd10d3ab

Download Submit
memory/760-7-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/760-8-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-9-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-11-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/760-14-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-15-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-16-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-18-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-13-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-22-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-24-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-27-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-29-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-30-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-34-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-36-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-39-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-41-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-44-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-43-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-47-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-51-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-52-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-55-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-53-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-49-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-38-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-17-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-57-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-63-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-60-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-32-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-67-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-65-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-71-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-69-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-73-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-76-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-19-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-78-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-80-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-82-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-84-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-87-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-89-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-20-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-92-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-42-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-54-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-50-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-48-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-46-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-45-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-40-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-37-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-35-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-33-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-31-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-28-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-26-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-25-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-23-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-93-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download
memory/760-21-0x00000000032A0000-0x00000000042A0000-memory.dmp

Filesize
16.0MB

Download