modiloader | c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-01-2025 03:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe
Size

1.1MB
MD5

4603c75b3b7ae5c693adf7d08dfc72f8
SHA1

536fbca93073cbc2a19ed9be874086bc3acab2d5
SHA256

c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c
SHA512

237927752e93a65c93a6cfdbac6d6499a29c518a316d4fc3b0e6f1d736e84279ae1017e369b2fb0f25fd1970775622d493120a0792902aa6009fd91d5d4a4d81
SSDEEP

24576:WCcGj5EfZJsVJrjzh4dYEXvVzlFjG31di:Wi8GadRvVR2D

Score

10^/10

modiloader discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 61 IoCs

resource	yara_rule
behavioral1/memory/2816-2-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-6-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-9-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-7-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-11-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-12-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-8-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-10-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-13-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-14-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-15-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-16-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-17-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-22-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-25-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-28-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-31-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-35-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-39-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-44-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-48-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-50-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-54-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-58-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-62-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-65-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-69-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-73-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-77-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-82-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-18-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-19-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-24-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-30-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-29-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-38-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-34-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-40-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-43-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-51-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-60-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-57-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-64-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-55-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-70-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-75-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-49-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-47-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-36-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-85-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-67-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-72-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-78-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-80-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-33-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-32-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-27-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-26-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-23-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-21-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2
behavioral1/memory/2816-20-0x0000000002C00000-0x0000000003C00000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
732	hvphrsqL.pif

Loads dropped DLL 2 IoCs

pid	Process
2816	c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe
2816	c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lqsrhpvh = "C:\\Users\\Public\\Lqsrhpvh.url"	c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	drive.google.com
4	drive.google.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2816 set thread context of 732	2816	c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe	34

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 1928	2816	c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe	30
PID 2816 wrote to memory of 1928	2816	c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe	30
PID 2816 wrote to memory of 1928	2816	c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe	30
PID 2816 wrote to memory of 1928	2816	c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe	30
PID 2816 wrote to memory of 2148	2816	c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe	32
PID 2816 wrote to memory of 2148	2816	c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe	32
PID 2816 wrote to memory of 2148	2816	c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe	32
PID 2816 wrote to memory of 2148	2816	c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe	32
PID 2816 wrote to memory of 732	2816	c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe	34
PID 2816 wrote to memory of 732	2816	c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe	34
PID 2816 wrote to memory of 732	2816	c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe	34
PID 2816 wrote to memory of 732	2816	c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe	34
PID 2816 wrote to memory of 732	2816	c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe	34
PID 2816 wrote to memory of 732	2816	c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe	34

C:\Users\Admin\AppData\Local\Temp\c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe
"C:\Users\Admin\AppData\Local\Temp\c9bac4ac565d31203a6de79955a300771c1ee41f72c227bebff984c83eaa409c.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Public\LqsrhpvhF.cmd" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Public\Libraries\FX.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2148
- C:\Users\Public\Libraries\hvphrsqL.pif
  C:\Users\Public\Libraries\hvphrsqL.pif
  2⤵
  - Executes dropped EXE
  PID:732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Libraries\FX.cmd

Filesize
8KB

MD5
7821e3de3812e791cf3b223500d73bc9

SHA1
5e211b634ce77e6fee83ce8a5b8c9a37c8b81e1d

SHA256
3daa7f9eee129f61f7a452f7150ee21a1c4141586a37f37842b9c3bb53152a74

SHA512
6eae270065401626df97b73a255578bf27b4f4dea480954843823046ad95e40cf706c1a767c8765ef3ab48ea3a18498375614317ec00a9ef29a4dd21edbc5f26

Download Submit
C:\Users\Public\LqsrhpvhF.cmd

Filesize
11KB

MD5
f82aeb3b12f33250e404df6ec873dd1d

SHA1
bcf538f64457e8d19da89229479cafa9c4cce12f

SHA256
23b7417b47c7efb96fb7ce395e325dc831ab2ee03eadda59058d31bdbe9c1ea6

SHA512
6f9d6daeed78f45f0f83310b95f47cc0a96d1db1d7f6c2e2485d7a8ecb04fee9865eec3599fee2d67f3332f68a70059f1a6a40050b93ef44d55632c24d108977

Download Submit
\Users\Public\Libraries\hvphrsqL.pif

Filesize
171KB

MD5
22331abcc9472cc9dc6f37faf333aa2c

SHA1
2a001c30ba79a19ceaf6a09c3567c70311760aa4

SHA256
bdfa725ec2a2c8ea5861d9b4c2f608e631a183fca7916c1e07a28b656cc8ec0c

SHA512
c7f5baad732424b975a426867d3d8b5424aa830aa172ed0ff0ef630070bf2b4213750e123a36d8c5a741e22d3999ca1d7e77c62d4b77d6295b20a38114b7843c

Download Submit
memory/2816-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2816-2-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-1-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-4-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/2816-6-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-9-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-7-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-11-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-12-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-8-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-10-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-13-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-14-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-15-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-16-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-17-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-22-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-25-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-28-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-31-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-35-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-39-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-44-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-48-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-50-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-54-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-58-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-62-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-65-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-69-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-73-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-77-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-82-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-18-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-19-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-24-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-30-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-29-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-38-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-34-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-40-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-43-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-51-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-60-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-57-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-64-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-55-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-70-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-75-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-49-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-47-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-36-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-85-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-67-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-72-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-78-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-80-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-33-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-32-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-27-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-26-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-23-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-21-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download
memory/2816-20-0x0000000002C00000-0x0000000003C00000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads