modiloader | 1ba8750656f938a2b5331f4661769bf717633622f7d34ab50579a744a76e6de1

General

Target

0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
Size

721KB
MD5

0272ebc769de3f4498d247d85d345279
SHA1

650c9d36c8720b96e107261f7ef5a1a2f3c66a7f
SHA256

1ba8750656f938a2b5331f4661769bf717633622f7d34ab50579a744a76e6de1
SHA512

98c871fd9e91b5de629d969c7a7d59f2ede62f641cc5dbc3f1f5f0575a2cabb45a4a3e10e5c79a98af4b3bb062e2ed37bb4cb8dfe54b914268afa91b128eb6f7
SSDEEP

12288:WLSdMFGhORzQo66LiUTq0/wbJy9TzzLSV2uK5T2aG44bZH7s8l3f:WLSdRMGZB0Z7o2uY2w49pf

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3696-38-0x0000000000400000-0x0000000000719000-memory.dmp	modiloader_stage2

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\N:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\S:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\V:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\W:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\B:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\E:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\I:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\M:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\O:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\P:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\T:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\U:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\H:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\J:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\K:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\Y:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\R:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\Z:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\Q:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\X:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\A:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\G:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened (read-only)	\??\L:	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe

description	ioc	process
File opened for modification	F:\AutoRun.inf	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
File opened for modification	C:\AutoRun.inf	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

Processes:

0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\paramstr.txt	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe

description	pid	process	target process
PID 3696 wrote to memory of 208	3696	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe	IEXPLORE.EXE
PID 3696 wrote to memory of 208	3696	0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0272ebc769de3f4498d247d85d345279_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3696

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
2⤵
PID:208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\AutoRun.inf

Filesize
169B

MD5
0fd2b9b3fcbfac494162593e6a18184e

SHA1
37527b31a207584caa3458c283b380adeb725a9d

SHA256
5d70425bb52c108aa50fa37774561419745f44ae4e9b0a333d8b693d4782def9

SHA512
993609f9c2a950313df7890f7692d74b11225f0dbd22fc37f0b1d9ec85f07ed101f8c8f68d9f9cbb50016e56eb8c24f2efdd7057642699f10966ca8ff33708f0

Download Submit
memory/3696-15-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/3696-0-0x0000000000400000-0x0000000000719000-memory.dmp

Filesize
3.1MB

Download
memory/3696-12-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/3696-8-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/3696-10-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/3696-18-0x00000000035A0000-0x00000000035A1000-memory.dmp

Filesize
4KB

Download
memory/3696-17-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/3696-16-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/3696-13-0x0000000003580000-0x0000000003583000-memory.dmp

Filesize
12KB

Download
memory/3696-1-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/3696-11-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/3696-2-0x00000000023E0000-0x0000000002434000-memory.dmp

Filesize
336KB

Download
memory/3696-14-0x0000000003680000-0x0000000003681000-memory.dmp

Filesize
4KB

Download
memory/3696-5-0x0000000002610000-0x0000000002611000-memory.dmp

Filesize
4KB

Download
memory/3696-4-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/3696-3-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/3696-9-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/3696-7-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/3696-6-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/3696-38-0x0000000000400000-0x0000000000719000-memory.dmp

Filesize
3.1MB

Download
memory/3696-39-0x00000000023E0000-0x0000000002434000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads