modiloader | 7642560eee720a02704b72ae3fff541db3d4c84ad4db3de3b7b75e75f7374a1b

General

Target

021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
Size

629KB
MD5

021528e3281374358cf58f61cb99d483
SHA1

9daf380cf5a2e021dae18cd6d60e2d80a394b1e7
SHA256

7642560eee720a02704b72ae3fff541db3d4c84ad4db3de3b7b75e75f7374a1b
SHA512

cf038c7a74dcc349f4d31ab1db17be433e008ce07bcf01650144b5d736cc2b21e5a5ce7b90caa1c54b111eeb2d9c411ab72d26cc81d4099d7620f42391779a5f
SSDEEP

12288:Xzr/8Qq3o236iRXpcSO45+dUKutF3Z4mxxNwttfoOlMDwa4SMfhq:cQq3P3t3O45+q9tQmXktRll7rq

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2032-54-0x0000000000400000-0x0000000000514000-memory.dmp	modiloader_stage2
behavioral1/memory/2032-56-0x0000000003380000-0x0000000003480000-memory.dmp	modiloader_stage2
behavioral1/memory/2112-59-0x0000000000400000-0x0000000000514000-memory.dmp	modiloader_stage2
behavioral1/memory/2032-72-0x0000000000400000-0x0000000000514000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2972 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

FileManager.cmd

pid process

2112 FileManager.cmd

pid	process
2972	cmd.exe

pid	process
2112	FileManager.cmd

Loads dropped DLL 4 IoCs

Processes:

021528e3281374358cf58f61cb99d483_JaffaCakes118.exeWerFault.exe

pid	process
2032	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
2032	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
2108	WerFault.exe
2108	WerFault.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

021528e3281374358cf58f61cb99d483_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\L:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\N:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\Q:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\R:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\K:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\M:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\O:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\T:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\A:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\B:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\G:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\I:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\U:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\W:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\H:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\J:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\S:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\Z:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\Y:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\E:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\P:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\V:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened (read-only)	\??\X:	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

021528e3281374358cf58f61cb99d483_JaffaCakes118.exe

description	ioc	process
File opened for modification	F:\AutoRun.inf	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File created	C:\AutoRun.inf	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened for modification	C:\AutoRun.inf	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File created	F:\AutoRun.inf	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

FileManager.cmd

description pid process target process

PID 2112 set thread context of 2656 2112 FileManager.cmd explorer.exe

description	pid	process	target process
PID 2112 set thread context of 2656	2112	FileManager.cmd	explorer.exe

Drops file in Program Files directory 3 IoCs

Processes:

021528e3281374358cf58f61cb99d483_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FileManager.cmd	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FileManager.cmd	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

Processes:

FileManager.cmd

description ioc process

File created C:\Windows\_FileManager.cmd FileManager.cmd
File opened for modification C:\Windows\_FileManager.cmd FileManager.cmd
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2108 2112 WerFault.exe FileManager.cmd

description	ioc	process
File created	C:\Windows\_FileManager.cmd	FileManager.cmd
File opened for modification	C:\Windows\_FileManager.cmd	FileManager.cmd

pid	pid_target	process	target process
2108	2112	WerFault.exe	FileManager.cmd

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

021528e3281374358cf58f61cb99d483_JaffaCakes118.exeFileManager.cmd

description	pid	process	target process
PID 2032 wrote to memory of 2112	2032	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe	FileManager.cmd
PID 2032 wrote to memory of 2112	2032	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe	FileManager.cmd
PID 2032 wrote to memory of 2112	2032	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe	FileManager.cmd
PID 2032 wrote to memory of 2112	2032	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe	FileManager.cmd
PID 2112 wrote to memory of 2656	2112	FileManager.cmd	explorer.exe
PID 2112 wrote to memory of 2656	2112	FileManager.cmd	explorer.exe
PID 2112 wrote to memory of 2656	2112	FileManager.cmd	explorer.exe
PID 2112 wrote to memory of 2656	2112	FileManager.cmd	explorer.exe
PID 2112 wrote to memory of 2656	2112	FileManager.cmd	explorer.exe
PID 2112 wrote to memory of 2656	2112	FileManager.cmd	explorer.exe
PID 2112 wrote to memory of 2108	2112	FileManager.cmd	WerFault.exe
PID 2112 wrote to memory of 2108	2112	FileManager.cmd	WerFault.exe
PID 2112 wrote to memory of 2108	2112	FileManager.cmd	WerFault.exe
PID 2112 wrote to memory of 2108	2112	FileManager.cmd	WerFault.exe
PID 2032 wrote to memory of 2972	2032	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe	cmd.exe
PID 2032 wrote to memory of 2972	2032	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe	cmd.exe
PID 2032 wrote to memory of 2972	2032	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe	cmd.exe
PID 2032 wrote to memory of 2972	2032	021528e3281374358cf58f61cb99d483_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\021528e3281374358cf58f61cb99d483_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\021528e3281374358cf58f61cb99d483_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2032

C:\Program Files\Common Files\Microsoft Shared\MSINFO\FileManager.cmd
"C:\Program Files\Common Files\Microsoft Shared\MSINFO\FileManager.cmd"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2112

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\system32\explorer.exe"
3⤵
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 300
3⤵
- Loads dropped DLL
- Program crash
PID:2108

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat""
2⤵
- Deletes itself
PID:2972

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSInfo\ReDelBat.bat
Filesize
212B

MD5
8444990a9afcab9cc71a5e3b0a997a02

SHA1
bce747e36283df96d7411551a2dd4f381131ea88

SHA256
a20e2a7eeaf94d8c8e5769996dafa1025c859199d40760065d518baa412223cb

SHA512
bed30e2c5508b3f7208a6b9ab683d443ad4be810794f1375169769e97a75854a204d3ca4b77cbd385a95d4d85d58514fed0024cd537fa7bdd475f7c6535ec2ed

Download Submit
F:\FileManager.cmd
Filesize
629KB

MD5
021528e3281374358cf58f61cb99d483

SHA1
9daf380cf5a2e021dae18cd6d60e2d80a394b1e7

SHA256
7642560eee720a02704b72ae3fff541db3d4c84ad4db3de3b7b75e75f7374a1b

SHA512
cf038c7a74dcc349f4d31ab1db17be433e008ce07bcf01650144b5d736cc2b21e5a5ce7b90caa1c54b111eeb2d9c411ab72d26cc81d4099d7620f42391779a5f

Download Submit
memory/2032-16-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2032-72-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2032-12-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/2032-15-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/2032-14-0x0000000003380000-0x0000000003383000-memory.dmp

Filesize
12KB

Download
memory/2032-13-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/2032-9-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/2032-8-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/2032-0-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2032-6-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/2032-5-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/2032-4-0x0000000002020000-0x0000000002021000-memory.dmp

Filesize
4KB

Download
memory/2032-19-0x00000000033B0000-0x00000000033B1000-memory.dmp

Filesize
4KB

Download
memory/2032-21-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2032-20-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/2032-18-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/2032-17-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2032-22-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/2032-7-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/2032-10-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/2032-74-0x0000000000350000-0x00000000003A4000-memory.dmp

Filesize
336KB

Download
memory/2032-11-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/2032-40-0x00000000046B0000-0x00000000047C4000-memory.dmp

Filesize
1.1MB

Download
memory/2032-41-0x00000000046B0000-0x00000000047C4000-memory.dmp

Filesize
1.1MB

Download
memory/2032-3-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2032-2-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2032-1-0x0000000000350000-0x00000000003A4000-memory.dmp

Filesize
336KB

Download
memory/2032-60-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/2032-54-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2032-55-0x0000000000350000-0x00000000003A4000-memory.dmp

Filesize
336KB

Download
memory/2032-57-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/2032-56-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/2112-59-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2112-63-0x0000000001EC0000-0x0000000001F14000-memory.dmp

Filesize
336KB

Download
memory/2112-43-0x0000000001EC0000-0x0000000001F14000-memory.dmp

Filesize
336KB

Download
memory/2112-42-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2656-50-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2656-47-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads