modiloader | d548e01ba094e4957b369e4bb0bc96c02559b2973879258237417e13bfeacae2

General

Target

102fd70e1cc78fa1a648d14f9d425087_JaffaCakes118.exe
Size

157KB
MD5

102fd70e1cc78fa1a648d14f9d425087
SHA1

176473670c63643a21d796a719674a7277bcd50c
SHA256

d548e01ba094e4957b369e4bb0bc96c02559b2973879258237417e13bfeacae2
SHA512

5d7832efa7b834ef3fd1751345d71f3e7557a6f736f71743bf8a40efd884c130966452e2597308e71153270c66244b7bf97b56318b0cef89fa90bb01231791f6
SSDEEP

3072:MXAScc0i+zmLUAcO8RE5PPDlUFCyCXGAac7ZxWGC2LWp9x8pNr15bzlngqDGGWq/:M1PcaV0AHDlfySGTc7W5tp+5bzlnriJY

Score

10^/10

modiloader persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/memory/2216-1-0x0000000000400000-0x000000000045C000-memory.dmp	modiloader_stage2
behavioral1/memory/2216-10-0x0000000000400000-0x000000000045C000-memory.dmp	modiloader_stage2

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Remote netControl Service\Parameters\ServiceDll = "C:\\Windows\\system32\\swqs.dll"	102fd70e1cc78fa1a648d14f9d425087_JaffaCakes118.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00270000000147d5-8.dat	acprotect

Deletes itself 1 IoCs

pid	Process
2996	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2404	svchost.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2404-9-0x0000000000270000-0x00000000002D5000-memory.dmp	upx
behavioral1/files/0x00270000000147d5-8.dat	upx
behavioral1/memory/2404-11-0x0000000000270000-0x00000000002D5000-memory.dmp	upx
behavioral1/memory/2404-12-0x0000000000270000-0x00000000002D5000-memory.dmp	upx
behavioral1/memory/2404-13-0x0000000000270000-0x00000000002D5000-memory.dmp	upx
behavioral1/memory/2404-14-0x0000000000270000-0x00000000002D5000-memory.dmp	upx
behavioral1/memory/2404-15-0x0000000000270000-0x00000000002D5000-memory.dmp	upx
behavioral1/memory/2404-16-0x0000000000270000-0x00000000002D5000-memory.dmp	upx
behavioral1/memory/2404-17-0x0000000000270000-0x00000000002D5000-memory.dmp	upx
behavioral1/memory/2404-18-0x0000000000270000-0x00000000002D5000-memory.dmp	upx
behavioral1/memory/2404-19-0x0000000000270000-0x00000000002D5000-memory.dmp	upx
behavioral1/memory/2404-20-0x0000000000270000-0x00000000002D5000-memory.dmp	upx
behavioral1/memory/2404-21-0x0000000000270000-0x00000000002D5000-memory.dmp	upx
behavioral1/memory/2404-22-0x0000000000270000-0x00000000002D5000-memory.dmp	upx
behavioral1/memory/2404-23-0x0000000000270000-0x00000000002D5000-memory.dmp	upx

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mon.dll	102fd70e1cc78fa1a648d14f9d425087_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mon.dll	102fd70e1cc78fa1a648d14f9d425087_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\swqs.dll	102fd70e1cc78fa1a648d14f9d425087_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\swqs.dll	102fd70e1cc78fa1a648d14f9d425087_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2996	2216	102fd70e1cc78fa1a648d14f9d425087_JaffaCakes118.exe	29
PID 2216 wrote to memory of 2996	2216	102fd70e1cc78fa1a648d14f9d425087_JaffaCakes118.exe	29
PID 2216 wrote to memory of 2996	2216	102fd70e1cc78fa1a648d14f9d425087_JaffaCakes118.exe	29
PID 2216 wrote to memory of 2996	2216	102fd70e1cc78fa1a648d14f9d425087_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\102fd70e1cc78fa1a648d14f9d425087_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\102fd70e1cc78fa1a648d14f9d425087_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\102fd70e1cc78fa1a648d14f9d425087_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  PID:2996

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k network
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\swqs.dll

Filesize
142KB

MD5
aa5d297b7ad4fccef082f9a47737eb8e

SHA1
ebe80227acd04d94abe99d95ee6c66c8d2456328

SHA256
e593f80df55f4cd72ba00d84c26cb28371c8c80bc197b9505409f5bc8a172e44

SHA512
b9f8ba1ff50ed518773086e89334dd051498b42045eef3b6f7e800d6a433310b442c3e5bf06e7a1baf861190b2e34fe4d46ea3226eedd91959842be552e01a37

Download Submit
memory/2216-10-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2216-1-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2216-4-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2216-0-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2404-13-0x0000000000270000-0x00000000002D5000-memory.dmp

Filesize
404KB

Download
memory/2404-17-0x0000000000270000-0x00000000002D5000-memory.dmp

Filesize
404KB

Download
memory/2404-12-0x0000000000270000-0x00000000002D5000-memory.dmp

Filesize
404KB

Download
memory/2404-9-0x0000000000270000-0x00000000002D5000-memory.dmp

Filesize
404KB

Download
memory/2404-14-0x0000000000270000-0x00000000002D5000-memory.dmp

Filesize
404KB

Download
memory/2404-15-0x0000000000270000-0x00000000002D5000-memory.dmp

Filesize
404KB

Download
memory/2404-16-0x0000000000270000-0x00000000002D5000-memory.dmp

Filesize
404KB

Download
memory/2404-11-0x0000000000270000-0x00000000002D5000-memory.dmp

Filesize
404KB

Download
memory/2404-18-0x0000000000270000-0x00000000002D5000-memory.dmp

Filesize
404KB

Download
memory/2404-19-0x0000000000270000-0x00000000002D5000-memory.dmp

Filesize
404KB

Download
memory/2404-20-0x0000000000270000-0x00000000002D5000-memory.dmp

Filesize
404KB

Download
memory/2404-21-0x0000000000270000-0x00000000002D5000-memory.dmp

Filesize
404KB

Download
memory/2404-22-0x0000000000270000-0x00000000002D5000-memory.dmp

Filesize
404KB

Download
memory/2404-23-0x0000000000270000-0x00000000002D5000-memory.dmp

Filesize
404KB

Download

Analysis

Sharing