modiloader | a65a9e13d34e41f5544f5a1e3690b95c1f4394d65de86c42afaaa9496a4b9981

General

Target

0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
Size

584KB
MD5

0016bdd1e1bdadcdbdc86c8ce3523502
SHA1

0837fbd506aaa8910a3c91b4f69a2e2b2b844bb2
SHA256

a65a9e13d34e41f5544f5a1e3690b95c1f4394d65de86c42afaaa9496a4b9981
SHA512

3f85a80bbc4ef5badb71817c349ceb8f724634f38c4ba50258a40eeaf3a855cd957d727ce69bdd34a13bd21088953c51936dfbef392554333b7d36768c8f4864
SSDEEP

12288:SQCvNHO+/uCmJ4Cl8hqHd77tF3Z4mxx0o3ABt4QCdeOf:SQHHCm47Q9XtQmX0Qut4QCde+

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4852-11-0x0000000003390000-0x000000000343B000-memory.dmp	modiloader_stage2
behavioral2/memory/4852-76-0x0000000000400000-0x0000000000559000-memory.dmp	modiloader_stage2

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\S:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\U:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\H:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\M:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\P:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\X:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\Y:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\A:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\G:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\K:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\J:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\L:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\Q:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\T:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\Z:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\B:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\E:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\I:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\V:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\W:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\N:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\O:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened (read-only)	\??\R:	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\AutoRun.inf	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
File opened for modification	F:\AutoRun.inf	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

Processes:

0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\paramstr.txt	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3216 4852 WerFault.exe 0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe

pid	pid_target	process	target process
3216	4852	WerFault.exe	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe

description	pid	process	target process
PID 4852 wrote to memory of 4224	4852	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe	IEXPLORE.EXE
PID 4852 wrote to memory of 4224	4852	0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0016bdd1e1bdadcdbdc86c8ce3523502_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4852

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
2⤵
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 684
2⤵
- Program crash
PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4852 -ip 4852
1⤵
PID:2136

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\AutoRun.inf
Filesize
169B

MD5
1da0b273a8dd7961b24c6163e6ae0de2

SHA1
7a4f5e9a6934cc9ef9166d3ef3adf2535ccad6b2

SHA256
705ff32cb59644357122365403e7b6ed3ed6a4e9789836321468b5cb5db97cae

SHA512
d4f7e3dedd726988ebef8fd0ea93dc380ba50862257ceae1c30e0e974402d850a057d74ef995d2ed909a70f5479437539396911d0ea05fc80669e2ef57c74cdb

Download Submit
memory/4852-1-0x0000000000A60000-0x0000000000AB4000-memory.dmp

Filesize
336KB

Download
memory/4852-0-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/4852-2-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4852-11-0x0000000003390000-0x000000000343B000-memory.dmp

Filesize
684KB

Download
memory/4852-10-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/4852-9-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/4852-8-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/4852-7-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/4852-6-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/4852-5-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/4852-4-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/4852-25-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-24-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-54-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-56-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-55-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-53-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-52-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-51-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-50-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-49-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-48-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-47-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-46-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-45-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-44-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-43-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-42-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-41-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-40-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-39-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-38-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-37-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-36-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-35-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-34-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-33-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-32-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-31-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-30-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-29-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-28-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-27-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-26-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-23-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-22-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-21-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-20-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-19-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-18-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-17-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-16-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-15-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-14-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-13-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4852-12-0x0000000003390000-0x000000000343B000-memory.dmp

Filesize
684KB

Download
memory/4852-3-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/4852-76-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/4852-78-0x0000000003390000-0x0000000003396000-memory.dmp

Filesize
24KB

Download
memory/4852-77-0x0000000000A60000-0x0000000000AB4000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads