modiloader | 6a3a296b6bc17c71c15089e59a07de7a564b694d1f841b382f3ec8b15bcff29d

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/03/2025, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
REF-REFERENCE-ORDER-QUOTATION-DETAILS.cmd
Size 5.0MB
Sample250303-l2qbcsvvev
SHA256 7b8008ab3703f5e1bfaf4d2970c133068fbdba704c311819e282c4456866afdc
MD5 61acf73d931438d77e85e31f3b5d8e6a
SHA1 2abe35f912290a8d4ddaa4485266e9d441d7eb13
SHA512 1efb0f8ec52b3ee0a3902ce89d70de6bcc117493f2a46265f8d1b1b7e50542b0f39b7a15e3f40a562cd98c591ac328c44504dee8f8f05186f750e26a3832f637
SSDEEP 49152:sZZC85MQCbNigm89TxcS/OCjapGp2eq2PDdpGuC3JClhJphPv/84LuSNtGaSy6Qm:C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2616-46-0x0000000003970000-0x0000000004970000-memory.dmp	modiloader_stage2

Executes dropped EXE 10 IoCs

pid	Process
2348	expha.pif
2984	expha.pif
2912	expha.pif
2260	alpha.pif
2856	ghf.pif
2884	alpha.pif
2764	ghf.pif
2852	alpha.pif
2780	rdha.pif
2616	ANYDESK.PIF

Loads dropped DLL 9 IoCs

pid	Process
3044	cmd.exe
3044	cmd.exe
3044	cmd.exe
3044	cmd.exe
2260	alpha.pif
3044	cmd.exe
2884	alpha.pif
3044	cmd.exe
3044	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ANYDESK.PIF

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2852	alpha.pif
2828	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2828	PING.EXE

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2408	3044	cmd.exe	31
PID 3044 wrote to memory of 2408	3044	cmd.exe	31
PID 3044 wrote to memory of 2408	3044	cmd.exe	31
PID 3044 wrote to memory of 2348	3044	cmd.exe	32
PID 3044 wrote to memory of 2348	3044	cmd.exe	32
PID 3044 wrote to memory of 2348	3044	cmd.exe	32
PID 3044 wrote to memory of 2984	3044	cmd.exe	33
PID 3044 wrote to memory of 2984	3044	cmd.exe	33
PID 3044 wrote to memory of 2984	3044	cmd.exe	33
PID 3044 wrote to memory of 2912	3044	cmd.exe	34
PID 3044 wrote to memory of 2912	3044	cmd.exe	34
PID 3044 wrote to memory of 2912	3044	cmd.exe	34
PID 3044 wrote to memory of 2260	3044	cmd.exe	35
PID 3044 wrote to memory of 2260	3044	cmd.exe	35
PID 3044 wrote to memory of 2260	3044	cmd.exe	35
PID 2260 wrote to memory of 2856	2260	alpha.pif	36
PID 2260 wrote to memory of 2856	2260	alpha.pif	36
PID 2260 wrote to memory of 2856	2260	alpha.pif	36
PID 3044 wrote to memory of 2884	3044	cmd.exe	37
PID 3044 wrote to memory of 2884	3044	cmd.exe	37
PID 3044 wrote to memory of 2884	3044	cmd.exe	37
PID 2884 wrote to memory of 2764	2884	alpha.pif	38
PID 2884 wrote to memory of 2764	2884	alpha.pif	38
PID 2884 wrote to memory of 2764	2884	alpha.pif	38
PID 3044 wrote to memory of 2852	3044	cmd.exe	39
PID 3044 wrote to memory of 2852	3044	cmd.exe	39
PID 3044 wrote to memory of 2852	3044	cmd.exe	39
PID 2852 wrote to memory of 2828	2852	alpha.pif	40
PID 2852 wrote to memory of 2828	2852	alpha.pif	40
PID 2852 wrote to memory of 2828	2852	alpha.pif	40
PID 3044 wrote to memory of 2780	3044	cmd.exe	41
PID 3044 wrote to memory of 2780	3044	cmd.exe	41
PID 3044 wrote to memory of 2780	3044	cmd.exe	41
PID 2780 wrote to memory of 2616	2780	rdha.pif	42
PID 2780 wrote to memory of 2616	2780	rdha.pif	42
PID 2780 wrote to memory of 2616	2780	rdha.pif	42
PID 2780 wrote to memory of 2616	2780	rdha.pif	42
PID 3044 wrote to memory of 2680	3044	cmd.exe	43
PID 3044 wrote to memory of 2680	3044	cmd.exe	43
PID 3044 wrote to memory of 2680	3044	cmd.exe	43

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\REF-REFERENCE-ORDER-QUOTATION-DETAILS.cmd"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\extrac32.exe
  extrac32 /C /Y "C:\\Windows\\System32\\extrac32.exe" "C:\\Users\\Public\\expha.pif"
  2⤵
  PID:2408
- C:\Users\Public\expha.pif
  C:\\Users\\Public\\expha.pif /C /Y "C:\\Windows\\System32\\cmd.exe" "C:\\Users\\Public\\alpha.pif"
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Users\Public\expha.pif
  C:\\Users\\Public\\expha.pif /C /Y "C:\\Windows\\System32\\rundll32.exe" "C:\\Users\\Public\\rdha.pif"
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Users\Public\expha.pif
  C:\\Users\\Public\\expha.pif /C /Y "C:\Windows\System32\certutil.exe" "C:\\Users\\Public\\ghf.pif"
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Users\Public\alpha.pif
  C:\\Users\\Public\\alpha.pif /C C:\\Users\\Public\\ghf.pif -decodehex -f "C:\Users\Admin\AppData\Local\Temp\REF-REFERENCE-ORDER-QUOTATION-DETAILS.cmd" "C:\Users\Public\HEW.3GP" 9
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Users\Public\ghf.pif
    C:\\Users\\Public\\ghf.pif -decodehex -f "C:\Users\Admin\AppData\Local\Temp\REF-REFERENCE-ORDER-QUOTATION-DETAILS.cmd" "C:\Users\Public\HEW.3GP" 9
    3⤵
    - Executes dropped EXE
    PID:2856
- C:\Users\Public\alpha.pif
  C:\\Users\\Public\\alpha.pif /C C:\\Users\\Public\\ghf.pif -decodehex -f "C:\Users\Public\HEW.3GP" "C:\Users\Public\ANYDESK.PIF" 12
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Users\Public\ghf.pif
    C:\\Users\\Public\\ghf.pif -decodehex -f "C:\Users\Public\HEW.3GP" "C:\Users\Public\ANYDESK.PIF" 12
    3⤵
    - Executes dropped EXE
    PID:2764
- C:\Users\Public\alpha.pif
  C:\\Users\\Public\\alpha.pif /c PING -n 2 127.0.0.1
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\system32\PING.EXE
    PING -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2828
- C:\Users\Public\rdha.pif
  C:\\Users\\Public\\rdha.pif zipfldr.dll,RouteTheCall C:\Users\Public\ANYDESK.PIF
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Users\Public\ANYDESK.PIF
    "C:\Users\Public\ANYDESK.PIF"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2616
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 0
  2⤵
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ANYDESK.PIF

Path C:\Users\Public\ANYDESK.PIF
Size 1.8MB
SHA256 256520046ad897ce5a4e7b6e2c784a58eac430a8f2f95db6b165016e498c50fe
MD5 156369a00149906afd0337340bfbcb30
SHA1 76cebc4789c364d4e6c8d86825f711b1f207ed9d
SHA512 ecdc0e2847c98fc2f9500ced5f1ecf8c700f3486183f325f9199bbbeee96842ecd2627c981a5ff69edb817b9cbfbe0a8bf2d56fe566b850ed7183965673d8c4a
SSDEEP 24576:95tC5kWkHIVTl45p3aLpZsZga6HP4t5ifmgGPsKG7STDh:9W7OQpZsq/v65pgGPb
MD5 SHA1 SHA512 SSDEEP

Submit Download

HEW.3GP

Path C:\Users\Public\HEW.3GP
Size 3.6MB
SHA256 2084f470cf1714f566e1c5161ebd61404dd57e1f72ee40e780398b4d664b3852
MD5 dd7e2c0019f2cf0d56ebf81a971991e3
SHA1 20618f1b2c53010d99dbc2cd62587f510d5403f2
SHA512 ac6703932655dafaa65723f7607be16fa146a41dd48a0a5a417d1a7b0993a30301b33167db3e51cdf7b13e8a456bf311d63ca8f9a7eeb7f4c7cdbf3e7e3d75b7
SSDEEP 24576:dyMVIPsYVb/whtRuixOPJBg5xXHFBzDC5eutBeucBeutBeucBeutBeucBeutBeuH:b
MD5 SHA1 SHA512 SSDEEP

Submit Download

rdha.pif

Path C:\Users\Public\rdha.pif
Size 44KB
SHA256 f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9
MD5 dd81d91ff3b0763c392422865c9ac12e
SHA1 963b55acc8c566876364716d5aafa353995812a8
SHA512 8a5036ccab9c9e71deb4ecb9598528ca19c2d697a836846d23e1547b24172fa236a798092c7db676929abff830e40f52ce8f3b3bdd8d4c2553d7c021fceaf120
SSDEEP 768:lC2UEwdMtWsxjR6l0eiJMVhbfMPURqbSEln5IyYpamDjobj8S:lkMtNoluMVdMPURqln5IUmDjoX
MD5 SHA1 SHA512 SSDEEP

Submit Download

alpha.pif

Path \Users\Public\alpha.pif
Size 337KB
SHA256 db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386
MD5 5746bd7e255dd6a8afa06f7c42c1ba41
SHA1 0f3c4ff28f354aede202d54e9d1c5529a3bf87d8
SHA512 3a968356d7b94cc014f78ca37a3c03f354c3970c9e027ed4ccb8e59f0f9f2a32bfa22e7d6b127d44631d715ea41bf8ace91f0b4d69d1714d55552b064ffeb69e
SSDEEP 6144:NVl7yDR2iaGcsVXFBM6IT77aVebJWC1jIdDWCoCX9Sm:jdyDRwpmFq6ITSebJWwjIdDbNS
MD5 SHA1 SHA512 SSDEEP

Submit Download

expha.pif

Path \Users\Public\expha.pif
Size 61KB
SHA256 baa9972f330ca0d701a36f3642d30f9266d03b371bcd246396cc9f24ac7e443f
MD5 7b3080bc1b915a7ca29d29e0b29c1a08
SHA1 7dcfbeabb512582a12d10f1c576565a90138351d
SHA512 8f7524d11c55a400fa69bb5c05815e5858e135485f8b85eb49ff4deb70b7bb6b702e09a8c7b61b128dd776c9c4061b28e7358af25cc31f0f16aca7168d19df46
SSDEEP 1536:Ilseqlh4nyAW8h7qWkurzAvAb4wvbAGeqOQ:IlsesinyZ8Eupk0beqX
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghf.pif

Path \Users\Public\ghf.pif
Size 1.1MB
SHA256 1e19c5a26215b62de1babd5633853344420c1e673bb83e8a89213085e17e16e3
MD5 ec1fd3050dbc40ec7e87ab99c7ca0b03
SHA1 ae7fdfc29f4ef31e38ebf381e61b503038b5cb35
SHA512 4e47331f2fdce77b01d86cf8e21cd7d6df13536f09b70c53e5a6b82f66512faa10e38645884c696b47a27ea6bddc6c1fdb905ee78684dca98cbda5f39fbafcc2
SSDEEP 24576:RvakvkaGNPQo9uU5goFKyb21SI91ZGUU2:davaSIGZgo8ykSINGJ2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2616-46-0x0000000003970000-0x0000000004970000-memory.dmp

Download

memory/2616-47-0x0000000000400000-0x00000000005D5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads