modiloader | 0768d3f5de2abcf20f04206da647cd67832451aeb139d59308d960bbde74f0e5

General

Target

8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
Size

397KB
MD5

8a0ebafe5a1dbe44336099a0980e28dd
SHA1

a72c35986c7edd0dc09c6c949c66785b2f42588f
SHA256

0768d3f5de2abcf20f04206da647cd67832451aeb139d59308d960bbde74f0e5
SHA512

93d0b8d91e17e4f4f61a87f2257dc5d9c0be626651a64289a24abf6b36de7b97e96755fe65f3c985a7fbbd6cbfaf23552aadeca25841d8cd177e9373847db06b
SSDEEP

6144:MLy84u9nSO2GjZkD10BIY3rb1YfBdfpoZ3u/Ht52w6JSeiFPXmd7:Y+u9nx2GjMY3XKfd/H/9Pu7

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1512-1-0x0000000000400000-0x000000000046A000-memory.dmp	modiloader_stage2

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe"	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe

pid	process
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
1512	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe

pid process

1512 8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1512

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1512-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1512-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads