modiloader | e0306403753079987e99e9d2940a03880b2d0519dd38a3449c65751d81365322

General

Target

013929c6ec9f2340af4f4f0a8c1e3ac3_JaffaCakes118.exe
Size

356KB
MD5

013929c6ec9f2340af4f4f0a8c1e3ac3
SHA1

9f8e1e2a15885e99119e66b388b2e56cd340f583
SHA256

e0306403753079987e99e9d2940a03880b2d0519dd38a3449c65751d81365322
SHA512

99edb8156a740b499e45901c113ae192053f214514cf7095d98626c25ffcad99a0dc1b6fe2933508f44ec469568486e182a06c4f1010df00ef50076f379c7031
SSDEEP

6144:zgtbjoS6ziXHgv8SOdyjT67oEFFC02yIJP+0EXhpR2U0jCb/hIqnSydZ9Pl0BtSa:zgtbMS6+wv8dzF2DP+VpaCbhIt8hl0Ka

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3520-4-0x0000000000400000-0x00000000004C3000-memory.dmp	modiloader_stage2
behavioral2/memory/3520-5-0x0000000000400000-0x00000000004C3000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

Processes:

013929c6ec9f2340af4f4f0a8c1e3ac3_JaffaCakes118.exe

description pid process target process

PID 3520 set thread context of 1288 3520 013929c6ec9f2340af4f4f0a8c1e3ac3_JaffaCakes118.exe IEXPLORE.EXE

description	pid	process	target process
PID 3520 set thread context of 1288	3520	013929c6ec9f2340af4f4f0a8c1e3ac3_JaffaCakes118.exe	IEXPLORE.EXE

Drops file in Program Files directory 1 IoCs

Processes:

013929c6ec9f2340af4f4f0a8c1e3ac3_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt	013929c6ec9f2340af4f4f0a8c1e3ac3_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5B08368D-2E95-11EF-9519-DAA7D34B912A} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425002327"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

1288 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

1288 IEXPLORE.EXE
1288 IEXPLORE.EXE
2824 IEXPLORE.EXE
2824 IEXPLORE.EXE
2824 IEXPLORE.EXE
2824 IEXPLORE.EXE

pid	process
1288	IEXPLORE.EXE

pid	process
1288	IEXPLORE.EXE
1288	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

013929c6ec9f2340af4f4f0a8c1e3ac3_JaffaCakes118.exeIEXPLORE.EXE

description	pid	process	target process
PID 3520 wrote to memory of 1288	3520	013929c6ec9f2340af4f4f0a8c1e3ac3_JaffaCakes118.exe	IEXPLORE.EXE
PID 3520 wrote to memory of 1288	3520	013929c6ec9f2340af4f4f0a8c1e3ac3_JaffaCakes118.exe	IEXPLORE.EXE
PID 3520 wrote to memory of 1288	3520	013929c6ec9f2340af4f4f0a8c1e3ac3_JaffaCakes118.exe	IEXPLORE.EXE
PID 3520 wrote to memory of 1288	3520	013929c6ec9f2340af4f4f0a8c1e3ac3_JaffaCakes118.exe	IEXPLORE.EXE
PID 1288 wrote to memory of 2824	1288	IEXPLORE.EXE	IEXPLORE.EXE
PID 1288 wrote to memory of 2824	1288	IEXPLORE.EXE	IEXPLORE.EXE
PID 1288 wrote to memory of 2824	1288	IEXPLORE.EXE	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\013929c6ec9f2340af4f4f0a8c1e3ac3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\013929c6ec9f2340af4f4f0a8c1e3ac3_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3520

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:17410 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2824

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1288-3-0x0000000000090000-0x0000000000153000-memory.dmp

Filesize
780KB

Download
memory/3520-0-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3520-1-0x00000000004BE000-0x00000000004BF000-memory.dmp

Filesize
4KB

Download
memory/3520-4-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/3520-5-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads