DBatLoader (ModiLoader/NatsoLoader): Delphi-Compiled Windows Loader Using Layered Anti-Analysis, Mock-Trusted-Directory UAC Bypass, and DLL Side-Loading to Deliver Remcos, FormBook, NetWire and Warzone
DBatLoader (ModiLoader/NatsoLoader) (TL-2026-0768), also tracked as ModiLoader, is a high-severity malware campaign, first published 2026-06-10. It has no confirmed attribution, affects Microsoft Windows, maps to 32 MITRE ATT&CK techniques (T1010, T1027, T1027.002), and is covered by 9 detection rules and 33 indicators of compromise.
Key facts for TL-2026-0768
- Threat ID
- TL-2026-0768
- Also known as
- ModiLoader, NatsoLoader
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-10
- Last reviewed
- 2026-06-10
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, logistics, construction, real estate, financial
- Target regions
- Europe, Eastern Europe
- Detection rules
- 9
- Indicators of compromise
- 33
Malware and tooling in DBatLoader (ModiLoader/NatsoLoader)
Malware and tooling: Agent Tesla, Formbook, NetWire RC, Remcos, Warzone
DBatLoader is a Delphi-compiled x86 Windows loader (aka ModiLoader/NatsoLoader) that establishes a foothold and delivers commodity RATs and stealers (Remcos, FormBook, NetWire, Warzone, Agent Tesla). It layers anti-analysis (import hiding, sandbox/debugger timing checks via GetTickCount/Sleep, high-entropy packed sections, image steganography) with a mock-trusted-directory UAC bypass (C:\Windows \System32 with a trailing space) and DLL side-loading of a malicious netutils.dll via the auto-elevated easinvoker.exe.
How DBatLoader (ModiLoader/NatsoLoader) works
DBatLoader, also tracked as ModiLoader and NatsoLoader, is a Delphi-compiled 32-bit Windows executable first identified in June 2020 and still actively distributed. It functions as a multi-stage loader whose sole purpose is to deliver follow-on malware while defeating static and dynamic analysis. Per Deep Instinct's DIANNA analysis (Aug 2025), the loader employs import hiding to obscure its API usage from static tools, measures execution timing with GetTickCount and Sleep to detect sandbox/emulation environments, and ships sections with abnormally high entropy consistent with packing/encryption. It leverages MAPI32.DLL, USER32.DLL, advapi32.dll, kernel32.dll and oleaut32.dll, and exhibits registry manipulation, code injection, screenshot capture, and potential keylogging.
The delivery chain (Zscaler ThreatLabz, IBM X-Force) is phishing-driven: malicious emails carry PDF, HTML, OneNote (.one), ISO, LNK or SCR lures that fetch a CAB archive or directly drop the Delphi loader. Payloads are frequently staged on compromised WordPress sites with valid SSL certificates and public cloud services (OneDrive, Google Drive) to blend with legitimate traffic. The first-stage loader hides a second stage as an encrypted GIF in its resource section; decryption adds 79 to each byte (with overflow handling) to reconstruct a DLL that is mapped via VirtualAlloc and executed in memory.
DBatLoader's signature evasion is the 'mock trusted directories' UAC bypass: it creates C:\Windows \System32 (note the trailing space after 'Windows', a path that cannot be created through Explorer), copies a legitimate auto-elevating Windows binary (easinvoker.exe) plus a rogue netutils.dll into it, and triggers DLL side-loading to run code at high integrity without a UAC prompt. It drops batch scripts (e.g. KDECO.bat, XdfiifagO.bat) into C:\Users\Public\Libraries, adds a PowerShell Microsoft Defender exclusion for C:\Users, and establishes persistence via an HKCU Run key and a startup .url internet shortcut (e.g. gafiifdX.url). Observed final payloads include Remcos RAT, FormBook, NetWire RAT, Warzone RAT and Agent Tesla, with campaigns concentrating on manufacturing and other European businesses. No CVE is associated with this loader; severity is HIGH based on active in-the-wild use, UAC bypass, and breadth of delivered payloads.
MITRE ATT&CK techniques used in TL-2026-0768
Discovery
T1010 Application Window Discovery; T1082 System Information Discovery; T1124 System Time Discovery; T1518.001 Security Software Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1027.002 Software Packing; T1027.003 Steganography; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1070.004 File Deletion; T1070.006 Timestomp; T1140 Deobfuscate/Decode Files or Information; T1497.003 Time Based Checks
Collection
T1056.001 Keylogging; T1113 Screen Capture; T1560 Archive Collected Data
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1568 Dynamic Resolution; T1571 Non-Standard Port; T1573 Encrypted Channel
Persistence
T1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1548.002 Bypass User Account Control
Initial Access
T1566 Phishing; T1566.001 Spearphishing Attachment
stealth
defense-impairment
Affected products and versions in DBatLoader (ModiLoader/NatsoLoader)
- Microsoft — Windows
Vulnerable versions: x86/x64 Windows hosts running 32-bit Delphi loaders
Remediation for DBatLoader (ModiLoader/NatsoLoader)
Immediate actions
- Block known C2 endpoints (185.246.220.63, hallowed247.duckdns.org, thesquirrelgame.net, b-yy.xyz) at the perimeter
- Hunt for and remove any directory path containing a trailing space such as 'C:\Windows \System32'
- Quarantine and analyze any easinvoker.exe / netutils.dll pair found outside legitimate locations
- Inspect C:\Users\Public\Libraries for dropped .bat scripts (KDECO.bat, XdfiifagO.bat) and .url startup shortcuts
Workarounds
- Configure mark-of-the-web enforcement and block mounting of ISO/IMG containers delivered via email
- Disable OneNote embedded file execution via Office Trust Center / ADMX policy
Longer-term hardening
- Deploy EDR with behavioral detection for DLL side-loading and process injection
- Set Windows UAC to 'Always notify' to reduce mock-trusted-directory bypass effectiveness
- Block execution of LNK/SCR/ISO/OneNote attachments from email at the gateway
- Alert on PowerShell Add-MpPreference / Defender exclusion changes
- Restrict outbound traffic to OneDrive/Google Drive direct-download URLs where business policy allows
Weaknesses (CWE) in DBatLoader (ModiLoader/NatsoLoader)
CWE-426, CWE-427, CWE-250
Timeline of DBatLoader (ModiLoader/NatsoLoader)
- ModiLoader / DBatLoader / NatsoLoader first identified as a Delphi-compiled Windows loader.
- DBatLoader observed across phishing campaigns acting as a delivery vehicle for commodity RATs and stealers including Remcos, NetWire, FormBook, Warzone (Ave Maria) and Agent Tesla.
- SentinelOne documents DBatLoader activity targeting Eastern European entities.
- The Hacker News reports on stealthy DBatLoader spreading Remcos RAT and FormBook across Europe.
- Zscaler ThreatLabz documents DBatLoader retrieving its encrypted second-stage payload embedded via image steganography from public cloud services (Google Drive / Microsoft OneDrive) to evade network detection.
- Zscaler ThreatLabz publishes analysis of DBatLoader actively distributing Remcos and FormBook to European businesses, detailing the mock-trusted-directory UAC bypass and easinvoker.exe DLL side-loading.
- IBM X-Force-tracked campaigns observed DBatLoader establishing persistence via Run-key registry entries and a scheduled task / startup folder LNK pointing to the dropped payload in the ProgramData or %Public% directories.
- IBM X-Force observes nearly two dozen email campaigns since late June leveraging updated DBatLoader to deliver Remcos, Warzone, FormBook and Agent Tesla.
- Deep Instinct's DIANNA publishes 'Master of Disguise' analysis detailing import hiding, GetTickCount/Sleep timing-based sandbox detection, high-entropy packed sections, registry manipulation, code injection, screenshot capture and potential keylogging.
- Threat documented in Threadlinqs Intelligence Platform; C2 IP 185.246.220.63 checked against BeaconBeagle (no current beacon correlation returned).
Sources cited for DBatLoader (ModiLoader/NatsoLoader)
- DIANNA Explains #3: DBatLoader - Master of Disguise
- DBatLoader: Actively Distributing Malwares Targeting European Businesses
- Email campaigns leverage updated DBatLoader to deliver RATs, stealers
- Stealthy DBatLoader Malware Loader Spreading Remcos RAT and Formbook in Europe
- ModiLoader aka DBatLoader - Active IOCs
- DBatLoader Malware Analysis Overview by ANY.RUN
Threats related to DBatLoader (ModiLoader/NatsoLoader)
- Multi-Stage Steganographic Loader Delivers Remcos RAT and Rotating Infostealers via .NET Bitmap Resource Steganography and AppDomain.Load In-Memory Execution
- Remcos RAT: Technical Analysis of Windows Remote Access Trojan Operations
- SnappyClient RAT — C++ C2 Implant Delivered via HijackLoader (Operation Turb00 Part 3)
- Remcos RAT Delivered via Steganographic Multi-Stage Loader in 'GST Debit Note' India-Targeted Phishing Campaign
- WeedHack MaaS Infostealer — Trojanized Minecraft Mods/Clients via YouTube + SEO Poisoning, 36-Browser & Crypto-Wallet Credential Theft with Paid RAT Tier (CVE-N/A)
- GST Refund Phishing Delivers Remcos RAT via Multi-Stage .NET Bitmap-Steganography Infection Chain
Detection coverage for TL-2026-0768
As of 2026-06-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0768 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.