modiloader | 07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe
Size

90KB
MD5

46c9a83262aa91c0d95513a2ad6858d0
SHA1

e56ca731db467fbf6ed6ce92ed1d55a83c3352bc
SHA256

07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646
SHA512

b342e5904c996b4cb975ed7d1e130c3d664336b6c400ca4d164dd0dda23dabd2a553510abe091fc1c916611a9a293873df1b23dad317f7ec0584441c62cd3686
SSDEEP

1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y

Score

10^/10

modiloader persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
ModiLoader Second Stage 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2344-262-0x0000000000400000-0x0000000000414000-memory.dmp modiloader_stage2
Executes dropped EXE 3 IoCs

Processes:

csrsll.execsrsll.execsrsll.exe

pid process

1652 csrsll.exe
1420 csrsll.exe
2344 csrsll.exe

resource	yara_rule
behavioral1/memory/2344-262-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2

pid	process
1652	csrsll.exe
1420	csrsll.exe
2344	csrsll.exe

Loads dropped DLL 5 IoCs

Processes:

07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe

pid	process
2896	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe
2896	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe
2896	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe
2896	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe
2896	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2240-0-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2240-82-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2240-92-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2240-87-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2240-81-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2240-78-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2896-105-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2896-104-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2896-102-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2896-98-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2896-96-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2896-107-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2240-109-0x0000000000400000-0x0000000000453000-memory.dmp	upx
\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe	upx
behavioral1/memory/1652-154-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1652-214-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/1652-250-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2344-247-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2896-256-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1420-261-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2344-262-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe"	reg.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.execsrsll.exe

description	pid	process	target process
PID 2240 set thread context of 2896	2240	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe
PID 1652 set thread context of 1420	1652	csrsll.exe	csrsll.exe
PID 1652 set thread context of 2344	1652	csrsll.exe	csrsll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

csrsll.exe

description	pid	process
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe
Token: SeDebugPrivilege	1420	csrsll.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.execsrsll.execsrsll.exe

pid	process
2240	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe
2896	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe
1652	csrsll.exe
1420	csrsll.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.execmd.execsrsll.exe

description	pid	process	target process
PID 2240 wrote to memory of 2896	2240	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe
PID 2240 wrote to memory of 2896	2240	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe
PID 2240 wrote to memory of 2896	2240	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe
PID 2240 wrote to memory of 2896	2240	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe
PID 2240 wrote to memory of 2896	2240	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe
PID 2240 wrote to memory of 2896	2240	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe
PID 2240 wrote to memory of 2896	2240	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe
PID 2240 wrote to memory of 2896	2240	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe
PID 2896 wrote to memory of 1620	2896	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe	cmd.exe
PID 2896 wrote to memory of 1620	2896	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe	cmd.exe
PID 2896 wrote to memory of 1620	2896	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe	cmd.exe
PID 2896 wrote to memory of 1620	2896	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe	cmd.exe
PID 1620 wrote to memory of 2264	1620	cmd.exe	reg.exe
PID 1620 wrote to memory of 2264	1620	cmd.exe	reg.exe
PID 1620 wrote to memory of 2264	1620	cmd.exe	reg.exe
PID 1620 wrote to memory of 2264	1620	cmd.exe	reg.exe
PID 2896 wrote to memory of 1652	2896	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe	csrsll.exe
PID 2896 wrote to memory of 1652	2896	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe	csrsll.exe
PID 2896 wrote to memory of 1652	2896	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe	csrsll.exe
PID 2896 wrote to memory of 1652	2896	07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe	csrsll.exe
PID 1652 wrote to memory of 1420	1652	csrsll.exe	csrsll.exe
PID 1652 wrote to memory of 1420	1652	csrsll.exe	csrsll.exe
PID 1652 wrote to memory of 1420	1652	csrsll.exe	csrsll.exe
PID 1652 wrote to memory of 1420	1652	csrsll.exe	csrsll.exe
PID 1652 wrote to memory of 1420	1652	csrsll.exe	csrsll.exe
PID 1652 wrote to memory of 1420	1652	csrsll.exe	csrsll.exe
PID 1652 wrote to memory of 1420	1652	csrsll.exe	csrsll.exe
PID 1652 wrote to memory of 1420	1652	csrsll.exe	csrsll.exe
PID 1652 wrote to memory of 2344	1652	csrsll.exe	csrsll.exe
PID 1652 wrote to memory of 2344	1652	csrsll.exe	csrsll.exe
PID 1652 wrote to memory of 2344	1652	csrsll.exe	csrsll.exe
PID 1652 wrote to memory of 2344	1652	csrsll.exe	csrsll.exe
PID 1652 wrote to memory of 2344	1652	csrsll.exe	csrsll.exe
PID 1652 wrote to memory of 2344	1652	csrsll.exe	csrsll.exe
PID 1652 wrote to memory of 2344	1652	csrsll.exe	csrsll.exe
PID 1652 wrote to memory of 2344	1652	csrsll.exe	csrsll.exe

C:\Users\Admin\AppData\Local\Temp\07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240

C:\Users\Admin\AppData\Local\Temp\07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\07b86ca0cf284c050690313e049c096d061802ce4ab0019239b462f969811646_NeikiAnalytics.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\EAWVN.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f
4⤵
- Adds Run key to start application
PID:2264

C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652

C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1420

C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
4⤵
- Executes dropped EXE
PID:2344

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\EAWVN.bat
Filesize
145B

MD5
4eb61ec7816c34ec8c125acadc57ec1b

SHA1
b0015cc865c0bb1a027be663027d3829401a31cc

SHA256
08375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff

SHA512
f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
Filesize
90KB

MD5
82aa7297f13623f110574fc6a241fad2

SHA1
eb98ba52c6a5cd947964b1d7fa256b54e30d41fd

SHA256
5c7091f44ee4c6e55bad46ccd3a56c85ab3e3271b9a14559619fece0182963ad

SHA512
5925b3a2b6838129e1977f9f63f63ed1cceabbe2d1ea9c21b4f2ef14c141021908a73d30deabe4dce544f105e485cc37afdd3d430e868a564840274e5f2d08fe

Download Submit
memory/1420-261-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1652-250-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1652-214-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1652-167-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1652-178-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/1652-157-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1652-154-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2240-92-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2240-70-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2240-87-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2240-81-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2240-79-0x00000000003A0000-0x00000000003A2000-memory.dmp

Filesize
8KB

Download
memory/2240-78-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2240-93-0x0000000002790000-0x00000000027E3000-memory.dmp

Filesize
332KB

Download
memory/2240-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2240-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2240-15-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2240-27-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2240-39-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2240-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2240-60-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2240-55-0x0000000000404000-0x0000000000405000-memory.dmp

Filesize
4KB

Download
memory/2240-109-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2240-82-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2344-247-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2344-262-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2896-100-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2896-148-0x0000000003450000-0x00000000034A3000-memory.dmp

Filesize
332KB

Download
memory/2896-96-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2896-98-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2896-107-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2896-102-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2896-104-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2896-105-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2896-149-0x0000000003450000-0x00000000034A3000-memory.dmp

Filesize
332KB

Download
memory/2896-256-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2896-94-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2896-150-0x0000000003450000-0x00000000034A3000-memory.dmp

Filesize
332KB

Download