modiloader | ee8bb17b29c350019de834663898767f6a2e53341b5af7d606ecd9c6b8f5e4aa

General

Target

02f2cf085e68878772b165fd8f08fb9d_JaffaCakes118.exe
Size

164KB
MD5

02f2cf085e68878772b165fd8f08fb9d
SHA1

c21ec6af7b6803f2318b2977be23ee6d4a1458d2
SHA256

ee8bb17b29c350019de834663898767f6a2e53341b5af7d606ecd9c6b8f5e4aa
SHA512

9aca6130a91ea90e5bbcd9a8f57b7a803a77d54bf119dd8f6bacf0bde1f6759f4c8406e79656da65fc636a9787ff1bec0ec841903dff562b21d930369d6fd043
SSDEEP

3072:amZXdmmXxLg7GkK4ymIpaKjfFMFZt4+4SqyR+6yiO+NrVFxp/r/RGLOfx:amHHRdkhgaQfQCDxyR+zidVpDRrJ

Score

10^/10

modiloader trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 8 IoCs

Processes:

resource	yara_rule
behavioral2/memory/952-6-0x0000000013140000-0x00000000131CB000-memory.dmp	modiloader_stage2
behavioral2/memory/400-45-0x0000000010410000-0x000000001046F000-memory.dmp	modiloader_stage2
behavioral2/memory/400-48-0x0000000010410000-0x000000001046F000-memory.dmp	modiloader_stage2
behavioral2/memory/400-47-0x0000000010410000-0x000000001046F000-memory.dmp	modiloader_stage2
behavioral2/memory/400-44-0x0000000010410000-0x000000001046F000-memory.dmp	modiloader_stage2
behavioral2/memory/400-43-0x0000000010410000-0x000000001046F000-memory.dmp	modiloader_stage2
behavioral2/memory/408-49-0x0000000013140000-0x00000000131CB000-memory.dmp	modiloader_stage2
behavioral2/memory/400-50-0x0000000010410000-0x000000001046F000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

netservice.exe

pid process

408 netservice.exe

pid	process
408	netservice.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/408-7-0x0000000010410000-0x000000001046F000-memory.dmp	upx
behavioral2/memory/408-39-0x0000000010410000-0x000000001046F000-memory.dmp	upx
behavioral2/memory/400-45-0x0000000010410000-0x000000001046F000-memory.dmp	upx
behavioral2/memory/400-48-0x0000000010410000-0x000000001046F000-memory.dmp	upx
behavioral2/memory/400-47-0x0000000010410000-0x000000001046F000-memory.dmp	upx
behavioral2/memory/400-44-0x0000000010410000-0x000000001046F000-memory.dmp	upx
behavioral2/memory/400-43-0x0000000010410000-0x000000001046F000-memory.dmp	upx
behavioral2/memory/400-50-0x0000000010410000-0x000000001046F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

netservice.exe

description pid process

Token: SeDebugPrivilege 408 netservice.exe

description	pid	process
Token: SeDebugPrivilege	408	netservice.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

02f2cf085e68878772b165fd8f08fb9d_JaffaCakes118.exenetservice.exe

description	pid	process	target process
PID 952 wrote to memory of 1788	952	02f2cf085e68878772b165fd8f08fb9d_JaffaCakes118.exe	cmd.exe
PID 952 wrote to memory of 1788	952	02f2cf085e68878772b165fd8f08fb9d_JaffaCakes118.exe	cmd.exe
PID 952 wrote to memory of 1788	952	02f2cf085e68878772b165fd8f08fb9d_JaffaCakes118.exe	cmd.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe
PID 408 wrote to memory of 400	408	netservice.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\02f2cf085e68878772b165fd8f08fb9d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02f2cf085e68878772b165fd8f08fb9d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\SysWOW64\cmd.exe
cmd /c del "C:\Users\Admin\AppData\Local\Temp\02f2cf085e68878772b165fd8f08fb9d_JaffaCakes118.exe"
2⤵
PID:1788

C:\Users\Admin\Favorites\netservice.exe
C:\Users\Admin\Favorites\netservice.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:408

C:\Windows\SysWOW64\svchost.exe
C:\Windows\System32\svchost.exe
2⤵
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Favorites\netservice.exe

Filesize
164KB

MD5
02f2cf085e68878772b165fd8f08fb9d

SHA1
c21ec6af7b6803f2318b2977be23ee6d4a1458d2

SHA256
ee8bb17b29c350019de834663898767f6a2e53341b5af7d606ecd9c6b8f5e4aa

SHA512
9aca6130a91ea90e5bbcd9a8f57b7a803a77d54bf119dd8f6bacf0bde1f6759f4c8406e79656da65fc636a9787ff1bec0ec841903dff562b21d930369d6fd043

Download Submit
memory/400-44-0x0000000010410000-0x000000001046F000-memory.dmp

Filesize
380KB

Download
memory/400-45-0x0000000010410000-0x000000001046F000-memory.dmp

Filesize
380KB

Download
memory/400-50-0x0000000010410000-0x000000001046F000-memory.dmp

Filesize
380KB

Download
memory/400-43-0x0000000010410000-0x000000001046F000-memory.dmp

Filesize
380KB

Download
memory/400-9-0x0000000001350000-0x0000000001351000-memory.dmp

Filesize
4KB

Download
memory/400-8-0x0000000001290000-0x0000000001291000-memory.dmp

Filesize
4KB

Download
memory/400-47-0x0000000010410000-0x000000001046F000-memory.dmp

Filesize
380KB

Download
memory/400-42-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/400-48-0x0000000010410000-0x000000001046F000-memory.dmp

Filesize
380KB

Download
memory/408-39-0x0000000010410000-0x000000001046F000-memory.dmp

Filesize
380KB

Download
memory/408-7-0x0000000010410000-0x000000001046F000-memory.dmp

Filesize
380KB

Download
memory/408-49-0x0000000013140000-0x00000000131CB000-memory.dmp

Filesize
556KB

Download
memory/952-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/952-0-0x0000000013140000-0x00000000131CB000-memory.dmp

Filesize
556KB

Download
memory/952-6-0x0000000013140000-0x00000000131CB000-memory.dmp

Filesize
556KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads