modiloader | e5f96b91e4461e6c135b59975d96b0a049825440ba21408c94f89d88a0b7413f

General

Target
ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe
Size 398KB
Sample240411-29egtsbe71
SHA256 e5f96b91e4461e6c135b59975d96b0a049825440ba21408c94f89d88a0b7413f
MD5 ee92bfa71b3ff3c1fec7d8128de1a93d
SHA1 105e7f5a43a90cbb148fe72950fd717c478e13e8
SHA512 5a9e92eaba507d9aa02b911bb4fc57acf5012fb432330ef60d623e4c7e5f06b1c1cc8240dcb0722a0b2626d4452ba1011d3f007aff128fceaa46c3345d9f91b6
SSDEEP 12288:6pZ3P18DwSoHr9iBkD+s07qGLcvQU3XZlkVh:qVHrLD+D7/6rXjk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/4764-15-0x0000000000400000-0x00000000004D1A54-memory.dmp	modiloader_stage2
behavioral2/memory/2728-18-0x0000000000400000-0x00000000004D1A54-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
2728	MSInfo.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_MSInfo.exe	MSInfo.exe
File opened for modification	C:\Windows\SysWOW64\_MSInfo.exe	MSInfo.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4764	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe
2728	MSInfo.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2728 set thread context of 5092	2728	MSInfo.exe	85

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\MSInfo.exe	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\MSInfo.exe	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3980	2728	WerFault.exe	84
4408	5092	WerFault.exe	85

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 2728	4764	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe	84
PID 4764 wrote to memory of 2728	4764	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe	84
PID 4764 wrote to memory of 2728	4764	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe	84
PID 2728 wrote to memory of 5092	2728	MSInfo.exe	85
PID 2728 wrote to memory of 5092	2728	MSInfo.exe	85
PID 2728 wrote to memory of 5092	2728	MSInfo.exe	85
PID 2728 wrote to memory of 5092	2728	MSInfo.exe	85
PID 2728 wrote to memory of 5092	2728	MSInfo.exe	85
PID 2728 wrote to memory of 1464	2728	MSInfo.exe	87
PID 2728 wrote to memory of 1464	2728	MSInfo.exe	87
PID 4764 wrote to memory of 4804	4764	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe	96
PID 4764 wrote to memory of 4804	4764	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe	96
PID 4764 wrote to memory of 4804	4764	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe	96

C:\Users\Admin\AppData\Local\Temp\ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\MSInfo.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\MSInfo.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\system32\mmc.exe"
    3⤵
    PID:5092
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 12
      4⤵
      Program crash
      PID:4408
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    PID:1464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 664
    3⤵
    - Program crash
    PID:3980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat""
  2⤵
  PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5092 -ip 5092
1⤵
PID:1104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2728 -ip 2728
1⤵
PID:4636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DelSvel.bat

Path C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat
Size 212B
SHA256 b736abcd03c660f8684f8e3a7b8f27be6cfc5f16a2a99e45e7d5b65d80af0d20
MD5 e47700e209fc0b607ec1707afab6de0d
SHA1 3501b49b2c7d347b1209b6c17946876c23f35c7c
SHA512 656c8f7fad3479632a1d57538036779e5be16e2989b3fb36a99ce01c304952f79cf412b85e0ba57af2aa0a1ced7fcebb79ac8a2e241246c4da8c9d63bb8d65d7
MD5 SHA1 SHA512

Submit Download

MSInfo.exe

Path C:\Program Files\Common Files\microsoft shared\MSInfo\MSInfo.exe
Size 398KB
SHA256 e5f96b91e4461e6c135b59975d96b0a049825440ba21408c94f89d88a0b7413f
MD5 ee92bfa71b3ff3c1fec7d8128de1a93d
SHA1 105e7f5a43a90cbb148fe72950fd717c478e13e8
SHA512 5a9e92eaba507d9aa02b911bb4fc57acf5012fb432330ef60d623e4c7e5f06b1c1cc8240dcb0722a0b2626d4452ba1011d3f007aff128fceaa46c3345d9f91b6
SSDEEP 12288:6pZ3P18DwSoHr9iBkD+s07qGLcvQU3XZlkVh:qVHrLD+D7/6rXjk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2728-7-0x0000000000400000-0x00000000004D1A54-memory.dmp

Download

memory/2728-10-0x0000000002690000-0x0000000002691000-memory.dmp

Download

memory/2728-18-0x0000000000400000-0x00000000004D1A54-memory.dmp

Download

memory/4764-0-0x0000000000400000-0x00000000004D1A54-memory.dmp

Download

memory/4764-1-0x00000000028C0000-0x00000000028C1000-memory.dmp

Download

memory/4764-15-0x0000000000400000-0x00000000004D1A54-memory.dmp

Download

memory/5092-11-0x0000000000400000-0x00000000004D2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads