# DBatLoader (ModiLoader/NatsoLoader): Delphi-Compiled Windows Loader Using Layered Anti-Analysis, Mock-Trusted-Directory UAC Bypass, and DLL Side-Loading to Deliver Remcos, FormBook, NetWire and Warzone

> DBatLoader is a Delphi-compiled x86 Windows loader (aka ModiLoader/NatsoLoader) that establishes a foothold and delivers commodity RATs and stealers (Remcos, FormBook, NetWire, Warzone, Agent Tesla). It layers anti-analysis (import hiding, sandbox/debugger timing checks via GetTickCount/Sleep, high-entropy packed sections, image steganography) with a mock-trusted-directory UAC bypass (C:\Windows \System32 with a trailing space) and DLL side-loading of a malicious netutils.dll via the auto-elevated easinvoker.exe.

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-06-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0768
- **ID:** TL-2026-0768
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)

## Description

DBatLoader, also tracked as ModiLoader and NatsoLoader, is a Delphi-compiled 32-bit Windows executable first identified in June 2020 and still actively distributed. It functions as a multi-stage loader whose sole purpose is to deliver follow-on malware while defeating static and dynamic analysis. Per Deep Instinct's DIANNA analysis (Aug 2025), the loader employs import hiding to obscure its API usage from static tools, measures execution timing with GetTickCount and Sleep to detect sandbox/emulation environments, and ships sections with abnormally high entropy consistent with packing/encryption. It leverages MAPI32.DLL, USER32.DLL, advapi32.dll, kernel32.dll and oleaut32.dll, and exhibits registry manipulation, code injection, screenshot capture, and potential keylogging.

The delivery chain (Zscaler ThreatLabz, IBM X-Force) is phishing-driven: malicious emails carry PDF, HTML, OneNote (.one), ISO, LNK or SCR lures that fetch a CAB archive or directly drop the Delphi loader. Payloads are frequently staged on compromised WordPress sites with valid SSL certificates and public cloud services (OneDrive, Google Drive) to blend with legitimate traffic. The first-stage loader hides a second stage as an encrypted GIF in its resource section; decryption adds 79 to each byte (with overflow handling) to reconstruct a DLL that is mapped via VirtualAlloc and executed in memory.

DBatLoader's signature evasion is the 'mock trusted directories' UAC bypass: it creates C:\Windows \System32 (note the trailing space after 'Windows', a path that cannot be created through Explorer), copies a legitimate auto-elevating Windows binary (easinvoker.exe) plus a rogue netutils.dll into it, and triggers DLL side-loading to run code at high integrity without a UAC prompt. It drops batch scripts (e.g. KDECO.bat, XdfiifagO.bat) into C:\Users\Public\Libraries, adds a PowerShell Microsoft Defender exclusion for C:\Users, and establishes persistence via an HKCU Run key and a startup .url internet shortcut (e.g. gafiifdX.url). Observed final payloads include Remcos RAT, FormBook, NetWire RAT, Warzone RAT and Agent Tesla, with campaigns concentrating on manufacturing and other European businesses. No CVE is associated with this loader; severity is HIGH based on active in-the-wild use, UAC bypass, and breadth of delivered payloads.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1547.001 Registry Run Keys / Startup Folder
- T1574.001 DLL
- T1548.002 Bypass User Account Control
- T1027 Obfuscated Files or Information
- T1027.002 Software Packing
- T1027.003 Steganography
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1036.005 Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools
- T1497.003 Time Based Checks
- T1055 Process Injection
- T1070.004 File Deletion
- T1070.006 Timestomp
- T1124 System Time Discovery
- T1518.001 Security Software Discovery
- T1010 Application Window Discovery
- T1082 System Information Discovery
- T1113 Screen Capture
- T1056.001 Keylogging
- T1560 Archive Collected Data
- T1105 Ingress Tool Transfer
- T1071.001 Web Protocols
- T1219 Remote Access Tools
- T1568 Dynamic Resolution
- T1573 Encrypted Channel
- T1571 Non-Standard Port

## Sources

- [DIANNA Explains #3: DBatLoader - Master of Disguise](https://www.deepinstinct.com/blog/dianna-explains-3-dbatloader-master-of-disguise)
- [DBatLoader: Actively Distributing Malwares Targeting European Businesses](https://www.zscaler.com/blogs/security-research/dbatloader-actively-distributing-malwares-targeting-european-businesses)
- [Email campaigns leverage updated DBatLoader to deliver RATs, stealers](https://www.ibm.com/think/x-force/email-campaigns-leverage-updated-dbatloader-deliver-rats-stealers)
- [Stealthy DBatLoader Malware Loader Spreading Remcos RAT and Formbook in Europe](https://thehackernews.com/2023/03/stealthy-dbatloader-malware-loader.html)
- [ModiLoader aka DBatLoader - Active IOCs](https://www.rewterz.com/threat-advisory/modiloader-aka-dbatloader-active-iocs)
- [DBatLoader Malware Analysis Overview by ANY.RUN](https://any.run/malware-trends/dbatloader/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0768