modiloader | d2dc9dfd7ae6ed8a492dab9cf5862a8b694825ec0e9ddc464bb5854f63fb8c84

General

Target

154dda0df54054a6558f063093ff754b_JaffaCakes118.exe
Size

270KB
MD5

154dda0df54054a6558f063093ff754b
SHA1

14371d30fddc10647279ad13e93cb18f4f4a27e5
SHA256

d2dc9dfd7ae6ed8a492dab9cf5862a8b694825ec0e9ddc464bb5854f63fb8c84
SHA512

4854403919208a04f7b8a691111d6dc6b6f2cfd3614a9e664bca4d9b8a36964e3aa3274fbd612ce72da4328fc573339d49f32ac5d0b50c208195233090e3c28b
SSDEEP

6144:B10d/oYkkiOrbU5qsVvAi9eTiYmTrQxgK94t8vkah4YtLE7LkPDfHZi:Md/rkkiOr45qsB3eOH/3aRIX

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral1/memory/2220-25-0x0000000000400000-0x000000000050D000-memory.dmp	modiloader_stage2
behavioral1/memory/2248-27-0x0000000000400000-0x000000000050D000-memory.dmp	modiloader_stage2
behavioral1/memory/2220-35-0x0000000000400000-0x000000000050D000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
2524	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2248	setv.exe

Loads dropped DLL 5 IoCs

pid	Process
2220	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe
2220	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe
2620	WerFault.exe
2620	WerFault.exe
2620	WerFault.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_setv.exe	setv.exe
File opened for modification	C:\Windows\SysWOW64\_setv.exe	setv.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2248 set thread context of 2380	2248	setv.exe	29

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\setv.exe	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\setv.exe	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2620	2248	WerFault.exe	28

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2248	2220	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe	28
PID 2220 wrote to memory of 2248	2220	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe	28
PID 2220 wrote to memory of 2248	2220	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe	28
PID 2220 wrote to memory of 2248	2220	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe	28
PID 2248 wrote to memory of 2380	2248	setv.exe	29
PID 2248 wrote to memory of 2380	2248	setv.exe	29
PID 2248 wrote to memory of 2380	2248	setv.exe	29
PID 2248 wrote to memory of 2380	2248	setv.exe	29
PID 2248 wrote to memory of 2380	2248	setv.exe	29
PID 2248 wrote to memory of 2380	2248	setv.exe	29
PID 2248 wrote to memory of 2620	2248	setv.exe	30
PID 2248 wrote to memory of 2620	2248	setv.exe	30
PID 2248 wrote to memory of 2620	2248	setv.exe	30
PID 2248 wrote to memory of 2620	2248	setv.exe	30
PID 2220 wrote to memory of 2524	2220	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2524	2220	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2524	2220	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2524	2220	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\154dda0df54054a6558f063093ff754b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\154dda0df54054a6558f063093ff754b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\setv.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\setv.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 280
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat""
  2⤵
  - Deletes itself
  PID:2524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSInfo\Delet.bat

Filesize
212B

MD5
5a09f8ded1d02d9cb1a70f55ce03b1cb

SHA1
62adec856b6b595fe965e54d77a87e7f5d789019

SHA256
3a62670bded45b76b379b3ee02055b1946bb2a72360e73a6d6b3fce8f7e10203

SHA512
85564f83e306a6a4463d6f903447e77a4c30f98ed2017dc9539f7cf4307fe32fc111b130dcffe0a426fdc364e3e277f76ebe1a944bec535178850c41b100a041

Download Submit
\Program Files\Common Files\Microsoft Shared\MSInfo\setv.exe

Filesize
270KB

MD5
154dda0df54054a6558f063093ff754b

SHA1
14371d30fddc10647279ad13e93cb18f4f4a27e5

SHA256
d2dc9dfd7ae6ed8a492dab9cf5862a8b694825ec0e9ddc464bb5854f63fb8c84

SHA512
4854403919208a04f7b8a691111d6dc6b6f2cfd3614a9e664bca4d9b8a36964e3aa3274fbd612ce72da4328fc573339d49f32ac5d0b50c208195233090e3c28b

Download Submit
memory/2220-0-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2220-1-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2220-10-0x0000000002FF0000-0x00000000030FD000-memory.dmp

Filesize
1.1MB

Download
memory/2220-25-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2220-26-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2220-35-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2248-15-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2248-27-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2380-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2380-20-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing