modiloader | 1ba8750656f938a2b5331f4661769bf717633622f7d34ab50579a744a76e6de1

General

Target

0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
Size

721KB
MD5

0272ebc769de3f4498d247d85d345279
SHA1

650c9d36c8720b96e107261f7ef5a1a2f3c66a7f
SHA256

1ba8750656f938a2b5331f4661769bf717633622f7d34ab50579a744a76e6de1
SHA512

98c871fd9e91b5de629d969c7a7d59f2ede62f641cc5dbc3f1f5f0575a2cabb45a4a3e10e5c79a98af4b3bb062e2ed37bb4cb8dfe54b914268afa91b128eb6f7
SSDEEP

12288:WLSdMFGhORzQo66LiUTq0/wbJy9TzzLSV2uK5T2aG44bZH7s8l3f:WLSdRMGZB0Z7o2uY2w49pf

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2088-79-0x0000000000400000-0x0000000000719000-memory.dmp	modiloader_stage2

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\O:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\Z:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\B:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\I:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\J:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\N:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\S:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\U:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\W:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\Y:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\A:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\G:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\P:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\Q:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\E:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\M:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\R:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\X:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\V:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\H:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\K:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\L:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\T:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\AutoRun.inf	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened for modification	F:\AutoRun.inf	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

Processes:

0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\paramstr.txt	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe

description	pid	process	target process
PID 2088 wrote to memory of 2432	2088	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe	IEXPLORE.EXE
PID 2088 wrote to memory of 2432	2088	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe	IEXPLORE.EXE
PID 2088 wrote to memory of 2432	2088	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe	IEXPLORE.EXE
PID 2088 wrote to memory of 2432	2088	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2088

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
2⤵
PID:2432

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\AutoRun.inf
Filesize
169B

MD5
0fd2b9b3fcbfac494162593e6a18184e

SHA1
37527b31a207584caa3458c283b380adeb725a9d

SHA256
5d70425bb52c108aa50fa37774561419745f44ae4e9b0a333d8b693d4782def9

SHA512
993609f9c2a950313df7890f7692d74b11225f0dbd22fc37f0b1d9ec85f07ed101f8c8f68d9f9cbb50016e56eb8c24f2efdd7057642699f10966ca8ff33708f0

Download Submit
memory/2088-0-0x0000000000400000-0x0000000000719000-memory.dmp

Filesize
3.1MB

Download
memory/2088-1-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2088-2-0x0000000001FF0000-0x0000000002044000-memory.dmp

Filesize
336KB

Download
memory/2088-34-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-58-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2088-57-0x00000000035A0000-0x00000000035A1000-memory.dmp

Filesize
4KB

Download
memory/2088-56-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2088-55-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2088-54-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/2088-53-0x0000000003680000-0x0000000003681000-memory.dmp

Filesize
4KB

Download
memory/2088-52-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/2088-51-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/2088-50-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/2088-49-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/2088-48-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/2088-47-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/2088-46-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/2088-45-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/2088-44-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/2088-43-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/2088-42-0x0000000003580000-0x0000000003583000-memory.dmp

Filesize
12KB

Download
memory/2088-41-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-40-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-39-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-38-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-37-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-36-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-35-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-33-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-32-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-31-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-30-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-29-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-28-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-27-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-26-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-25-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-24-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-23-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-22-0x0000000003680000-0x0000000003681000-memory.dmp

Filesize
4KB

Download
memory/2088-21-0x0000000003680000-0x0000000003681000-memory.dmp

Filesize
4KB

Download
memory/2088-20-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2088-19-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2088-18-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2088-17-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2088-16-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2088-15-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2088-14-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2088-13-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2088-12-0x0000000003580000-0x0000000003680000-memory.dmp

Filesize
1024KB

Download
memory/2088-11-0x00000000020C0000-0x00000000020C1000-memory.dmp

Filesize
4KB

Download
memory/2088-10-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/2088-9-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/2088-8-0x0000000002610000-0x0000000002611000-memory.dmp

Filesize
4KB

Download
memory/2088-7-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/2088-6-0x00000000020B0000-0x00000000020B1000-memory.dmp

Filesize
4KB

Download
memory/2088-5-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/2088-4-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/2088-3-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/2088-79-0x0000000000400000-0x0000000000719000-memory.dmp

Filesize
3.1MB

Download
memory/2088-80-0x0000000001FF0000-0x0000000002044000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads