modiloader | fb6896e161ffd7a0c0afc2938ce529d0fad598c9fe89f347b137cc37a76f637e

General

Target

ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe
Size

281KB
MD5

ff35523562a0f9ff51ff4c17050b5220
SHA1

0f4ac5ca9cc5b11567140463805ebb5228fac17d
SHA256

fb6896e161ffd7a0c0afc2938ce529d0fad598c9fe89f347b137cc37a76f637e
SHA512

486814d30f4852694e3a3e22b902431bff5eb0b832554a5e5a27daf3edc04aa71d23925ce571b1ef4c519060db3a5fca13114175e1c33167764351995fce72cb
SSDEEP

6144:ZV0jzqVArhFdSEnFYtGtr6PKypSHEKoLMZDZn/m1zBNMGCl6ct:IjSGhFgEnFYtE0KA2EKooZDZn/m1PMnd

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 5 IoCs

resource	yara_rule
behavioral1/memory/2936-2-0x0000000000400000-0x0000000000516200-memory.dmp	modiloader_stage2
behavioral1/memory/272-16-0x0000000000400000-0x0000000000516200-memory.dmp	modiloader_stage2
behavioral1/memory/2936-32-0x0000000000400000-0x0000000000516200-memory.dmp	modiloader_stage2
behavioral1/memory/272-33-0x0000000000400000-0x0000000000516200-memory.dmp	modiloader_stage2
behavioral1/memory/2936-41-0x0000000000400000-0x0000000000516200-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
2504	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
272	stemy.exe

Loads dropped DLL 5 IoCs

pid	Process
2936	ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe
2936	ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe
2552	WerFault.exe
2552	WerFault.exe
2552	WerFault.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_stemy.exe	stemy.exe
File opened for modification	C:\Windows\SysWOW64\_stemy.exe	stemy.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 272 set thread context of 3044	272	stemy.exe	29

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\stemy.exe	ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SgotoDel.bat	ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\stemy.exe	ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2552	272	WerFault.exe	28

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 272	2936	ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe	28
PID 2936 wrote to memory of 272	2936	ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe	28
PID 2936 wrote to memory of 272	2936	ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe	28
PID 2936 wrote to memory of 272	2936	ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe	28
PID 272 wrote to memory of 3044	272	stemy.exe	29
PID 272 wrote to memory of 3044	272	stemy.exe	29
PID 272 wrote to memory of 3044	272	stemy.exe	29
PID 272 wrote to memory of 3044	272	stemy.exe	29
PID 272 wrote to memory of 3044	272	stemy.exe	29
PID 272 wrote to memory of 3044	272	stemy.exe	29
PID 272 wrote to memory of 2552	272	stemy.exe	30
PID 272 wrote to memory of 2552	272	stemy.exe	30
PID 272 wrote to memory of 2552	272	stemy.exe	30
PID 272 wrote to memory of 2552	272	stemy.exe	30
PID 2936 wrote to memory of 2504	2936	ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe	31
PID 2936 wrote to memory of 2504	2936	ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe	31
PID 2936 wrote to memory of 2504	2936	ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe	31
PID 2936 wrote to memory of 2504	2936	ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ff35523562a0f9ff51ff4c17050b5220_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\stemy.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\stemy.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:272
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:3044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 272 -s 280
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SgotoDel.bat""
  2⤵
  - Deletes itself
  PID:2504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSInfo\SgotoDel.bat

Filesize
212B

MD5
6df7075b2373981ac635dee7702cdb03

SHA1
928c30d640746954cfc9fd920f9756084d9d8b2c

SHA256
3110640a5fdb4ee004e3a0c3c899ad4b108179a9bc76711fb78422b11d62cc86

SHA512
a70f23ad1cbc00abb80207137bc5c2e02671ff9ce135a55dd44b1d62c42924f91ee332f550e51f52b9d72312a4baf0488aeca549878599688c35702962a75169

Download Submit
\Program Files\Common Files\Microsoft Shared\MSInfo\stemy.exe

Filesize
281KB

MD5
ff35523562a0f9ff51ff4c17050b5220

SHA1
0f4ac5ca9cc5b11567140463805ebb5228fac17d

SHA256
fb6896e161ffd7a0c0afc2938ce529d0fad598c9fe89f347b137cc37a76f637e

SHA512
486814d30f4852694e3a3e22b902431bff5eb0b832554a5e5a27daf3edc04aa71d23925ce571b1ef4c519060db3a5fca13114175e1c33167764351995fce72cb

Download Submit
memory/272-15-0x0000000000400000-0x0000000000516200-memory.dmp

Filesize
1.1MB

Download
memory/272-33-0x0000000000400000-0x0000000000516200-memory.dmp

Filesize
1.1MB

Download
memory/272-21-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/272-17-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/272-16-0x0000000000400000-0x0000000000516200-memory.dmp

Filesize
1.1MB

Download
memory/2936-14-0x0000000003020000-0x0000000003137000-memory.dmp

Filesize
1.1MB

Download
memory/2936-0-0x0000000000400000-0x0000000000516200-memory.dmp

Filesize
1.1MB

Download
memory/2936-12-0x0000000003020000-0x0000000003137000-memory.dmp

Filesize
1.1MB

Download
memory/2936-5-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2936-32-0x0000000000400000-0x0000000000516200-memory.dmp

Filesize
1.1MB

Download
memory/2936-2-0x0000000000400000-0x0000000000516200-memory.dmp

Filesize
1.1MB

Download
memory/2936-1-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2936-41-0x0000000000400000-0x0000000000516200-memory.dmp

Filesize
1.1MB

Download
memory/3044-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3044-26-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing