modiloader | d2dc9dfd7ae6ed8a492dab9cf5862a8b694825ec0e9ddc464bb5854f63fb8c84

General

Target
154dda0df54054a6558f063093ff754b_JaffaCakes118.exe
Size 270KB
Sample240627-j9cdcstcpn
SHA256 d2dc9dfd7ae6ed8a492dab9cf5862a8b694825ec0e9ddc464bb5854f63fb8c84
MD5 154dda0df54054a6558f063093ff754b
SHA1 14371d30fddc10647279ad13e93cb18f4f4a27e5
SHA512 4854403919208a04f7b8a691111d6dc6b6f2cfd3614a9e664bca4d9b8a36964e3aa3274fbd612ce72da4328fc573339d49f32ac5d0b50c208195233090e3c28b
SSDEEP 6144:B10d/oYkkiOrbU5qsVvAi9eTiYmTrQxgK94t8vkah4YtLE7LkPDfHZi:Md/rkkiOr45qsB3eOH/3aRIX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/4732-16-0x0000000000400000-0x000000000050D000-memory.dmp	modiloader_stage2
behavioral2/memory/212-17-0x0000000000400000-0x000000000050D000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
4732	setv.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_setv.exe	setv.exe
File opened for modification	C:\Windows\SysWOW64\_setv.exe	setv.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4732 set thread context of 856	4732	setv.exe	91
PID 4732 set thread context of 4544	4732	setv.exe	92

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\setv.exe	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\setv.exe	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4420	4544	WerFault.exe	92
3756	856	WerFault.exe	91

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 4732	212	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe	90
PID 212 wrote to memory of 4732	212	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe	90
PID 212 wrote to memory of 4732	212	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe	90
PID 4732 wrote to memory of 856	4732	setv.exe	91
PID 4732 wrote to memory of 856	4732	setv.exe	91
PID 4732 wrote to memory of 856	4732	setv.exe	91
PID 4732 wrote to memory of 856	4732	setv.exe	91
PID 4732 wrote to memory of 856	4732	setv.exe	91
PID 4732 wrote to memory of 4544	4732	setv.exe	92
PID 4732 wrote to memory of 4544	4732	setv.exe	92
PID 4732 wrote to memory of 4544	4732	setv.exe	92
PID 4732 wrote to memory of 4544	4732	setv.exe	92
PID 4732 wrote to memory of 4544	4732	setv.exe	92
PID 212 wrote to memory of 3604	212	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe	94
PID 212 wrote to memory of 3604	212	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe	94
PID 212 wrote to memory of 3604	212	154dda0df54054a6558f063093ff754b_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\154dda0df54054a6558f063093ff754b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\154dda0df54054a6558f063093ff754b_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:212
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\setv.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\setv.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:856
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 12
      4⤵
      Program crash
      PID:3756
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:4544
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 12
      4⤵
      Program crash
      PID:4420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat""
  2⤵
  PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4544 -ip 4544
1⤵
PID:516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 856 -ip 856
1⤵
PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4084,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:8
1⤵
PID:368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Delet.bat

Path C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat
Size 212B
SHA256 3a62670bded45b76b379b3ee02055b1946bb2a72360e73a6d6b3fce8f7e10203
MD5 5a09f8ded1d02d9cb1a70f55ce03b1cb
SHA1 62adec856b6b595fe965e54d77a87e7f5d789019
SHA512 85564f83e306a6a4463d6f903447e77a4c30f98ed2017dc9539f7cf4307fe32fc111b130dcffe0a426fdc364e3e277f76ebe1a944bec535178850c41b100a041
MD5 SHA1 SHA512

Submit Download

setv.exe

Path C:\Program Files\Common Files\microsoft shared\MSInfo\setv.exe
Size 270KB
SHA256 d2dc9dfd7ae6ed8a492dab9cf5862a8b694825ec0e9ddc464bb5854f63fb8c84
MD5 154dda0df54054a6558f063093ff754b
SHA1 14371d30fddc10647279ad13e93cb18f4f4a27e5
SHA512 4854403919208a04f7b8a691111d6dc6b6f2cfd3614a9e664bca4d9b8a36964e3aa3274fbd612ce72da4328fc573339d49f32ac5d0b50c208195233090e3c28b
SSDEEP 6144:B10d/oYkkiOrbU5qsVvAi9eTiYmTrQxgK94t8vkah4YtLE7LkPDfHZi:Md/rkkiOr45qsB3eOH/3aRIX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-0-0x0000000000400000-0x000000000050D000-memory.dmp

Download

memory/212-1-0x0000000002080000-0x0000000002081000-memory.dmp

Download

memory/212-17-0x0000000000400000-0x000000000050D000-memory.dmp

Download

memory/856-11-0x0000000000400000-0x000000000050D000-memory.dmp

Download

memory/4732-6-0x0000000000400000-0x000000000050D000-memory.dmp

Download

memory/4732-10-0x00000000006E0000-0x00000000006E1000-memory.dmp

Download

memory/4732-16-0x0000000000400000-0x000000000050D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads