modiloader | 0768d3f5de2abcf20f04206da647cd67832451aeb139d59308d960bbde74f0e5

General

Target

8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
Size

397KB
MD5

8a0ebafe5a1dbe44336099a0980e28dd
SHA1

a72c35986c7edd0dc09c6c949c66785b2f42588f
SHA256

0768d3f5de2abcf20f04206da647cd67832451aeb139d59308d960bbde74f0e5
SHA512

93d0b8d91e17e4f4f61a87f2257dc5d9c0be626651a64289a24abf6b36de7b97e96755fe65f3c985a7fbbd6cbfaf23552aadeca25841d8cd177e9373847db06b
SSDEEP

6144:MLy84u9nSO2GjZkD10BIY3rb1YfBdfpoZ3u/Ht52w6JSeiFPXmd7:Y+u9nx2GjMY3XKfd/H/9Pu7

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/208-1-0x0000000000400000-0x000000000046A000-memory.dmp	modiloader_stage2
behavioral2/memory/208-10-0x0000000000400000-0x000000000046A000-memory.dmp	modiloader_stage2

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe"	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe

pid	process
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
208	8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8a0ebafe5a1dbe44336099a0980e28dd_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:208

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/208-0-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/208-1-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/208-10-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads