modiloader | 50d58f3bd8eece301f8a6dda5159f5a2f8769d0d97aec133f1eae3a4665b49e6

General

Target

00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
Size

620KB
MD5

00d65b51da1e62f713a634679924b4a2
SHA1

a804276e193a3f3e242ad144cbc7d253ac8b51e1
SHA256

50d58f3bd8eece301f8a6dda5159f5a2f8769d0d97aec133f1eae3a4665b49e6
SHA512

f782256cf4e321ca001bb7c6010eb82ece392b005b921d40ca9ebc2ed705a92f4c332a2f9f1e755408947bae24111f9518bd63ed952b84da95b4168c658be036
SSDEEP

12288:PT0zDxahDgtZmwje94K/OAF3Z4mxxaZytbtOOIRS:PO+Dbwje9bLQmXAw

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4756-75-0x0000000000400000-0x0000000000513000-memory.dmp	modiloader_stage2
behavioral2/memory/1596-78-0x0000000000400000-0x0000000000513000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

windows_ipcomfig

pid process

1596 windows_ipcomfig

pid	process
1596	windows_ipcomfig

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\B:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\H:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\J:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\N:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\O:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\P:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\S:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\A:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\Z:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\K:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\R:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\T:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\V:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\Y:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\I:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\G:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\M:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\U:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\X:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\E:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\Q:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\W:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened (read-only)	\??\L:	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\AutoRun.inf	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File created	F:\AutoRun.inf	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened for modification	F:\AutoRun.inf	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File created	C:\AutoRun.inf	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe

Drops file in Program Files directory 2 IoCs

Processes:

windows_ipcomfig

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\_windows_ipcomfig	windows_ipcomfig
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\_windows_ipcomfig	windows_ipcomfig

Drops file in Windows directory 3 IoCs

Processes:

00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\windows_ipcomfig	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File opened for modification	C:\Windows\windows_ipcomfig	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
File created	C:\Windows\SgotoDel.bat	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1268 1596 WerFault.exe windows_ipcomfig

pid	pid_target	process	target process
1268	1596	WerFault.exe	windows_ipcomfig

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exewindows_ipcomfig

description	pid	process	target process
PID 4756 wrote to memory of 1596	4756	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe	windows_ipcomfig
PID 4756 wrote to memory of 1596	4756	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe	windows_ipcomfig
PID 4756 wrote to memory of 1596	4756	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe	windows_ipcomfig
PID 1596 wrote to memory of 3560	1596	windows_ipcomfig	IEXPLORE.EXE
PID 1596 wrote to memory of 3560	1596	windows_ipcomfig	IEXPLORE.EXE
PID 4756 wrote to memory of 4984	4756	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe	cmd.exe
PID 4756 wrote to memory of 4984	4756	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe	cmd.exe
PID 4756 wrote to memory of 4984	4756	00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00d65b51da1e62f713a634679924b4a2_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4756

C:\Windows\windows_ipcomfig
C:\Windows\windows_ipcomfig
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1596

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
3⤵
PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 684
3⤵
- Program crash
PID:1268

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\SgotoDel.bat
2⤵
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1596 -ip 1596
1⤵
PID:4296

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SgotoDel.bat
Filesize
212B

MD5
3ee84fb381a9315eb3aea3dfd286a52d

SHA1
184a3fba83b9c6a8098d515c26d0135670cb1a6e

SHA256
1e342370ee60541fa466b802e44b11239db6a58dd8eb683c46f0ccae474aabbc

SHA512
2c4f47237705dcf38b08560e7ae695609a2769d0eca4b71a199f7c9125847dd79e622c7eed2d1a287499857eba42d852dd54802474b0b15665d03ae36f45983e

Download Submit
F:\windows_ipcomfig
Filesize
620KB

MD5
00d65b51da1e62f713a634679924b4a2

SHA1
a804276e193a3f3e242ad144cbc7d253ac8b51e1

SHA256
50d58f3bd8eece301f8a6dda5159f5a2f8769d0d97aec133f1eae3a4665b49e6

SHA512
f782256cf4e321ca001bb7c6010eb82ece392b005b921d40ca9ebc2ed705a92f4c332a2f9f1e755408947bae24111f9518bd63ed952b84da95b4168c658be036

Download Submit
memory/1596-69-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/1596-78-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/4756-1-0x0000000002180000-0x00000000021D4000-memory.dmp

Filesize
336KB

Download
memory/4756-0-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/4756-34-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-33-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-32-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-31-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-30-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-55-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-54-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-53-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-52-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-51-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-50-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-49-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-48-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-47-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-46-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-45-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-44-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-43-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-42-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-41-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-40-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-39-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-38-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-37-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-36-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-35-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-29-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-28-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-27-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-26-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-25-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-24-0x0000000003450000-0x0000000003451000-memory.dmp

Filesize
4KB

Download
memory/4756-23-0x0000000003450000-0x0000000003451000-memory.dmp

Filesize
4KB

Download
memory/4756-22-0x0000000003450000-0x0000000003451000-memory.dmp

Filesize
4KB

Download
memory/4756-21-0x0000000003450000-0x0000000003451000-memory.dmp

Filesize
4KB

Download
memory/4756-20-0x0000000003450000-0x0000000003451000-memory.dmp

Filesize
4KB

Download
memory/4756-19-0x0000000003450000-0x0000000003451000-memory.dmp

Filesize
4KB

Download
memory/4756-18-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/4756-17-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/4756-16-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/4756-15-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/4756-14-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/4756-13-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/4756-12-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/4756-11-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/4756-10-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/4756-9-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/4756-8-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/4756-7-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/4756-6-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/4756-5-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/4756-4-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4756-3-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/4756-2-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/4756-75-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/4756-76-0x0000000002180000-0x00000000021D4000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads