modiloader | c52f047f53bb8e7fb18b8eda3db59849a832172d87d21a03288a2350c5b53fc8

General

Target

0309410b23be54643f1978a007379d7d_JaffaCakes118.exe
Size

224KB
MD5

0309410b23be54643f1978a007379d7d
SHA1

d09303604b4cb563cde6e03f3be20a447dc37df6
SHA256

c52f047f53bb8e7fb18b8eda3db59849a832172d87d21a03288a2350c5b53fc8
SHA512

e3156b0635b41f652832dccbae6027c3bb1cee654c21db76aafd89e8f40b1dc225971f629bb9f60a10bd384164231e90b08cbce0867896a31108b1ae0c36cd87
SSDEEP

6144:NfJfRYjlo8x2eXH62gci4K0FAhOkdt0ULSjI996zlceqIYvj:ZJJklo8x2eX62g4KAAhOkDNSgmlNyvj

Score

10^/10

modiloader persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

0309410b23be54643f1978a007379d7d_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\System32\\userinit.exe,\"C:\\Users\\Admin\\Favorites\\netservice.exe\"un userinit.exe"	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4416-2-0x0000000000400000-0x0000000000482000-memory.dmp	modiloader_stage2
behavioral2/memory/4416-10-0x0000000000400000-0x0000000000482000-memory.dmp	modiloader_stage2

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4416-7-0x0000000010410000-0x0000000010494000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0309410b23be54643f1978a007379d7d_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 4416 0309410b23be54643f1978a007379d7d_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0309410b23be54643f1978a007379d7d_JaffaCakes118.exe

description	pid	process	target process
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe
PID 4416 wrote to memory of 1396	4416	0309410b23be54643f1978a007379d7d_JaffaCakes118.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\0309410b23be54643f1978a007379d7d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0309410b23be54643f1978a007379d7d_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" about:blank
2⤵
PID:1396

C:\Windows\SysWOW64\cmd.exe
cmd /c del "C:\Users\Admin\AppData\Local\Temp\0309410b23be54643f1978a007379d7d_JaffaCakes118.exe"
2⤵
PID:1964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4440 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4416-0-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4416-1-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/4416-2-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4416-7-0x0000000010410000-0x0000000010494000-memory.dmp

Filesize
528KB

Download
memory/4416-10-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads