modiloader | 47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe
Size

326KB
MD5

7343a00f58bfa5216755211249c5be80
SHA1

98a82e7ee859a3045fec8f114b405a80686bc3cf
SHA256

47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3
SHA512

e14863cbedd085b750bab5cc353961d1522f55b908f861fbd272a68a6380664a6e791ba03c934f168caf10b5e4bc413471bbbda7f3c35e228786c623beb06f90
SSDEEP

3072:h0e2A0wxDqUpM5scww4chO+O1BmP5DG0sg3i4XZ9WvDZHwdRX/L+gP38XV:h0sxD5cwohO+O1sVG0/pZ6iPC8

Score

10^/10

modiloader persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/572-247-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral1/memory/572-255-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2

Executes dropped EXE 3 IoCs

Processes:

csrsll.execsrsll.execsrsll.exe

pid process

2804 csrsll.exe
764 csrsll.exe
572 csrsll.exe

pid	process
2804	csrsll.exe
764	csrsll.exe
572	csrsll.exe

Loads dropped DLL 5 IoCs

Processes:

47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe

pid	process
2508	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe
2508	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe
2508	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe
2508	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe
2508	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/824-0-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2508-95-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/824-101-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2508-103-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2508-99-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2508-98-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2508-91-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2508-89-0x0000000000400000-0x000000000040B000-memory.dmp	upx
\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe	upx
behavioral1/memory/2804-145-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2804-221-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2804-244-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/572-247-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2508-249-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/764-246-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/764-254-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/572-255-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win Pdf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrsll.exe"	reg.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.execsrsll.exe

description	pid	process	target process
PID 824 set thread context of 2508	824	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe
PID 2804 set thread context of 764	2804	csrsll.exe	csrsll.exe
PID 2804 set thread context of 572	2804	csrsll.exe	csrsll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

csrsll.exe

description	pid	process
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe
Token: SeDebugPrivilege	764	csrsll.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.execsrsll.execsrsll.exe

pid	process
824	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe
2508	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe
2804	csrsll.exe
764	csrsll.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.execmd.execsrsll.exe

description	pid	process	target process
PID 824 wrote to memory of 2508	824	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe
PID 824 wrote to memory of 2508	824	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe
PID 824 wrote to memory of 2508	824	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe
PID 824 wrote to memory of 2508	824	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe
PID 824 wrote to memory of 2508	824	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe
PID 824 wrote to memory of 2508	824	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe
PID 824 wrote to memory of 2508	824	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe
PID 824 wrote to memory of 2508	824	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe
PID 2508 wrote to memory of 2520	2508	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe	cmd.exe
PID 2508 wrote to memory of 2520	2508	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe	cmd.exe
PID 2508 wrote to memory of 2520	2508	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe	cmd.exe
PID 2508 wrote to memory of 2520	2508	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe	cmd.exe
PID 2520 wrote to memory of 1720	2520	cmd.exe	reg.exe
PID 2520 wrote to memory of 1720	2520	cmd.exe	reg.exe
PID 2520 wrote to memory of 1720	2520	cmd.exe	reg.exe
PID 2520 wrote to memory of 1720	2520	cmd.exe	reg.exe
PID 2508 wrote to memory of 2804	2508	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe	csrsll.exe
PID 2508 wrote to memory of 2804	2508	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe	csrsll.exe
PID 2508 wrote to memory of 2804	2508	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe	csrsll.exe
PID 2508 wrote to memory of 2804	2508	47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe	csrsll.exe
PID 2804 wrote to memory of 764	2804	csrsll.exe	csrsll.exe
PID 2804 wrote to memory of 764	2804	csrsll.exe	csrsll.exe
PID 2804 wrote to memory of 764	2804	csrsll.exe	csrsll.exe
PID 2804 wrote to memory of 764	2804	csrsll.exe	csrsll.exe
PID 2804 wrote to memory of 764	2804	csrsll.exe	csrsll.exe
PID 2804 wrote to memory of 764	2804	csrsll.exe	csrsll.exe
PID 2804 wrote to memory of 764	2804	csrsll.exe	csrsll.exe
PID 2804 wrote to memory of 764	2804	csrsll.exe	csrsll.exe
PID 2804 wrote to memory of 572	2804	csrsll.exe	csrsll.exe
PID 2804 wrote to memory of 572	2804	csrsll.exe	csrsll.exe
PID 2804 wrote to memory of 572	2804	csrsll.exe	csrsll.exe
PID 2804 wrote to memory of 572	2804	csrsll.exe	csrsll.exe
PID 2804 wrote to memory of 572	2804	csrsll.exe	csrsll.exe
PID 2804 wrote to memory of 572	2804	csrsll.exe	csrsll.exe
PID 2804 wrote to memory of 572	2804	csrsll.exe	csrsll.exe
PID 2804 wrote to memory of 572	2804	csrsll.exe	csrsll.exe

C:\Users\Admin\AppData\Local\Temp\47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824

C:\Users\Admin\AppData\Local\Temp\47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\47a4aecf7e2895259532b8e407946e8a4ae4ae6cb3bb57b2f303655fa0a733a3_NeikiAnalytics.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\SIEDQ.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:2520

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Win Pdf" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe" /f
4⤵
- Adds Run key to start application
PID:1720

C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804

C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:764

C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe"
4⤵
- Executes dropped EXE
PID:572

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SIEDQ.bat
Filesize
145B

MD5
4eb61ec7816c34ec8c125acadc57ec1b

SHA1
b0015cc865c0bb1a027be663027d3829401a31cc

SHA256
08375cdb2e9819391f67f71e9718c15b48d3eaa452c54bd8fdd1f6a42e899aff

SHA512
f289f01d996dd643560370be8cdf8894e9a676ca3813f706c01ef5d705b9b18246c6cadf10d96edd433a616637b8a78fbd23c5738e76f1c4e671977b6d0cb6c1

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\csrsll.exe
Filesize
326KB

MD5
d49a0fa2c522054cd803a41d49d50382

SHA1
5bf2d1499add705be171dfc76ae438e086863a74

SHA256
3d9a060922e3a14677e9ffc40b4a4d954bcef7bc1fd6665abec477c5542ad6da

SHA512
2e1d80311cd5f8d229418de15e430fd6b81b97d40981e0421e9c0f2d2abeace4088262275d9d6bda811dda4eabb86ab838db9214a9408df4b2b69628a4f4a202

Download Submit
memory/572-255-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/572-247-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/764-246-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/764-254-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/824-39-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/824-69-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/824-101-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/824-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/824-102-0x0000000002790000-0x00000000027E4000-memory.dmp

Filesize
336KB

Download
memory/824-27-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/824-77-0x0000000000480000-0x0000000000482000-memory.dmp

Filesize
8KB

Download
memory/824-97-0x0000000000404000-0x0000000000405000-memory.dmp

Filesize
4KB

Download
memory/824-15-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/824-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/824-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/824-59-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2508-103-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2508-93-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2508-89-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2508-91-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2508-95-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2508-143-0x0000000003490000-0x00000000034E4000-memory.dmp

Filesize
336KB

Download
memory/2508-142-0x0000000003490000-0x00000000034E4000-memory.dmp

Filesize
336KB

Download
memory/2508-99-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2508-98-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2508-249-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2508-87-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2804-221-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2804-244-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2804-171-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2804-179-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2804-160-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2804-150-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2804-145-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download