modiloader | 3a54357ebc937cc9a6f9c7f4380884d0aabf0da6c10e454d2b62ed2d1acbf2ec

General

Target

036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
Size

157KB
MD5

036b36a6b90f58ef78ae66b673314b35
SHA1

57411adb0edafa91bd46c0a7cfaa52410d8cf72d
SHA256

3a54357ebc937cc9a6f9c7f4380884d0aabf0da6c10e454d2b62ed2d1acbf2ec
SHA512

60c017d50e5c972f045ed68355d3911867724cdd9ae7c16fd5a89c1d17e84978e5fcd1e4cd534739ac8c259741cb5ec3a9912bdbd813cc6504d103a61eb6d59e
SSDEEP

3072:EGbHwx3GsAFyQbXO0kwXmFRqAh+7QouCv8BATTy+zL9GwqRlcBapeEdmIMyXY:EG7u6jrkwvKaXR0cyYLF6lcBapBdd

Score

10^/10

modiloader defense_evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3220-2-0x0000000000400000-0x000000000046F000-memory.dmp	modiloader_stage2

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

Processes:

036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3220-0-0x0000000000400000-0x000000000046F000-memory.dmp	upx
behavioral2/memory/3220-2-0x0000000000400000-0x000000000046F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe"	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe

pid	process
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
3220	036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

explorer.exe

description	pid	process
Token: SeShutdownPrivilege	940	explorer.exe
Token: SeCreatePagefilePrivilege	940	explorer.exe
Token: SeShutdownPrivilege	940	explorer.exe
Token: SeCreatePagefilePrivilege	940	explorer.exe

C:\Users\Admin\AppData\Local\Temp\036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\036b36a6b90f58ef78ae66b673314b35_JaffaCakes118.exe"
1⤵
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:3220

C:\Windows\explorer.exe
explorer.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

1

T1562

Safe Mode Boot

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3220-0-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3220-1-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/3220-2-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3220-4-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads