modiloader | 5be715833a5cdb5badad519b37ab43bec5c54d540146c2da54051429a2bc777d

General

Target

0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe
Size

1.3MB
MD5

0024fc02303763c0fada4cc62aedc0c2
SHA1

826e858b5579aafb83ae141bcefe355cca8fb4d1
SHA256

5be715833a5cdb5badad519b37ab43bec5c54d540146c2da54051429a2bc777d
SHA512

3fecc9e4c2d2997098754e20687472c73ab9af897d60a88a6ee4200818d825c39538e9a072e748674e3f27afc7681aff11bd34e0ada843bdafc208b77a522839
SSDEEP

24576:485XGpqdv6btYJ5CcaoByEAhTtvaVVuD5cf5FkFDa9zMD+IV7DkML:B5XUyvC+Jc6pG96fz2NaMDkM

Score

10^/10

modiloader evasion themida trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe

ModiLoader Second Stage 21 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1028-6-0x0000000000401000-0x000000000041C000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-10-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-11-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-12-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-13-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-14-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-18-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-19-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-22-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-23-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-26-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-29-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-32-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-35-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-38-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-41-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-44-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-47-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-50-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-53-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2
behavioral1/memory/1028-56-0x0000000000400000-0x00000000006A2000-memory.dmp	modiloader_stage2

Loads dropped DLL 2 IoCs

Processes:

0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe

pid process

1028 0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe
1028 0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe

pid	process
1028	0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe
1028	0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe

Themida packer 20 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1028-10-0x0000000000400000-0x00000000006A2000-memory.dmp	themida
behavioral1/memory/1028-11-0x0000000000400000-0x00000000006A2000-memory.dmp	themida
behavioral1/memory/1028-12-0x0000000000400000-0x00000000006A2000-memory.dmp	themida
behavioral1/memory/1028-13-0x0000000000400000-0x00000000006A2000-memory.dmp	themida
behavioral1/memory/1028-14-0x0000000000400000-0x00000000006A2000-memory.dmp	themida
behavioral1/memory/1028-18-0x0000000000400000-0x00000000006A2000-memory.dmp	themida
behavioral1/memory/1028-19-0x0000000000400000-0x00000000006A2000-memory.dmp	themida
behavioral1/memory/1028-22-0x0000000000400000-0x00000000006A2000-memory.dmp	themida
behavioral1/memory/1028-23-0x0000000000400000-0x00000000006A2000-memory.dmp	themida
behavioral1/memory/1028-26-0x0000000000400000-0x00000000006A2000-memory.dmp	themida
behavioral1/memory/1028-29-0x0000000000400000-0x00000000006A2000-memory.dmp	themida
behavioral1/memory/1028-32-0x0000000000400000-0x00000000006A2000-memory.dmp	themida
behavioral1/memory/1028-35-0x0000000000400000-0x00000000006A2000-memory.dmp	themida
behavioral1/memory/1028-38-0x0000000000400000-0x00000000006A2000-memory.dmp	themida
behavioral1/memory/1028-41-0x0000000000400000-0x00000000006A2000-memory.dmp	themida
behavioral1/memory/1028-44-0x0000000000400000-0x00000000006A2000-memory.dmp	themida
behavioral1/memory/1028-47-0x0000000000400000-0x00000000006A2000-memory.dmp	themida
behavioral1/memory/1028-50-0x0000000000400000-0x00000000006A2000-memory.dmp	themida
behavioral1/memory/1028-53-0x0000000000400000-0x00000000006A2000-memory.dmp	themida
behavioral1/memory/1028-56-0x0000000000400000-0x00000000006A2000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe

pid process

1028 0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe

pid	process
1028	0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1028	0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe
Token: SeDebugPrivilege	1028	0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe

pid process

1028 0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe
1028 0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe

pid	process
1028	0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe
1028	0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0024fc02303763c0fada4cc62aedc0c2_JaffaCakes118.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1028

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\cmsetac.dll
Filesize
33KB

MD5
4b0612201bf511ec081dbaa63900b49a

SHA1
68b7f713218a74a7b3e8653f36569265e7886682

SHA256
64a6d7356e795e0c2b362ba8cc0a94e74b8c8bed394482a115be0613d5a1e718

SHA512
ca5cdfecf4166755f218d03c0ba44b5eb318ac9477e9959916cedffe9e7a24fc6b316830877cf198584b6af778dc49f703a838cc6f7aaa6d54ceed817568a6e5

Download Submit
\Users\Admin\AppData\Local\Temp\ntdtcstp.dll
Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
memory/1028-18-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/1028-56-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/1028-0-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1028-1-0x0000000001E60000-0x0000000001F42000-memory.dmp

Filesize
904KB

Download
memory/1028-10-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/1028-11-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/1028-12-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/1028-13-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/1028-16-0x00000000046E0000-0x00000000046EE000-memory.dmp

Filesize
56KB

Download
memory/1028-15-0x00000000041A0000-0x00000000041A8000-memory.dmp

Filesize
32KB

Download
memory/1028-14-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/1028-17-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1028-8-0x00000000046E0000-0x00000000046EE000-memory.dmp

Filesize
56KB

Download
memory/1028-6-0x0000000000401000-0x000000000041C000-memory.dmp

Filesize
108KB

Download
memory/1028-41-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/1028-23-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/1028-26-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/1028-29-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/1028-32-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/1028-35-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/1028-38-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/1028-22-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/1028-44-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/1028-47-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/1028-50-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/1028-53-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download
memory/1028-19-0x0000000000400000-0x00000000006A2000-memory.dmp

Filesize
2.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads