modiloader | 9c5e640f0e7790f959a9350e4f926986eb3468d1b7ebdc3a2b05cc61b89d891e

General

Target
1bd8aa91822bbf33deb57642ee994cca_JaffaCakes118.exe
Size 322KB
Sample240701-vvy5cszeke
SHA256 9c5e640f0e7790f959a9350e4f926986eb3468d1b7ebdc3a2b05cc61b89d891e
MD5 1bd8aa91822bbf33deb57642ee994cca
SHA1 7077daa975365704a5d33ed0846635340af2a8df
SHA512 ea6c29713cddfa401113621d33efeab67f7568f3593cad22b6262a2e91d0f76c413ee51511b9edba1736200b4b1329ef26cc80be65b622092f3d6a2686462a6f
SSDEEP 6144:HXaZkaxUyVhPj2rAqVFWWQMHhoj5jmdHbtmVFnMFJUxJl01:HXaZk6LL8VFzHo1jCbtmHMDZ1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral2/memory/2388-1-0x0000000000400000-0x000000000051A02E-memory.dmp	modiloader_stage2
behavioral2/memory/4336-14-0x0000000000400000-0x000000000051A02E-memory.dmp	modiloader_stage2
behavioral2/memory/2388-16-0x0000000000400000-0x000000000051A02E-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
4336	Network.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\_Network.exe	Network.exe
File created	C:\Windows\SysWOW64\_Network.exe	Network.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4336 set thread context of 4644	4336	Network.exe	94

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat	1bd8aa91822bbf33deb57642ee994cca_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Network.exe	1bd8aa91822bbf33deb57642ee994cca_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Network.exe	1bd8aa91822bbf33deb57642ee994cca_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2060	4644	WerFault.exe	94

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 4336	2388	1bd8aa91822bbf33deb57642ee994cca_JaffaCakes118.exe	93
PID 2388 wrote to memory of 4336	2388	1bd8aa91822bbf33deb57642ee994cca_JaffaCakes118.exe	93
PID 2388 wrote to memory of 4336	2388	1bd8aa91822bbf33deb57642ee994cca_JaffaCakes118.exe	93
PID 4336 wrote to memory of 4644	4336	Network.exe	94
PID 4336 wrote to memory of 4644	4336	Network.exe	94
PID 4336 wrote to memory of 4644	4336	Network.exe	94
PID 4336 wrote to memory of 4644	4336	Network.exe	94
PID 4336 wrote to memory of 4644	4336	Network.exe	94
PID 4336 wrote to memory of 4284	4336	Network.exe	95
PID 4336 wrote to memory of 4284	4336	Network.exe	95
PID 2388 wrote to memory of 8	2388	1bd8aa91822bbf33deb57642ee994cca_JaffaCakes118.exe	97
PID 2388 wrote to memory of 8	2388	1bd8aa91822bbf33deb57642ee994cca_JaffaCakes118.exe	97
PID 2388 wrote to memory of 8	2388	1bd8aa91822bbf33deb57642ee994cca_JaffaCakes118.exe	97

C:\Users\Admin\AppData\Local\Temp\1bd8aa91822bbf33deb57642ee994cca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1bd8aa91822bbf33deb57642ee994cca_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\Network.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\Network.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:4644
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 12
      4⤵
      Program crash
      PID:2060
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    PID:4284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat""
  2⤵
  PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4644 -ip 4644
1⤵
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3792 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Delet.bat

Path C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat
Size 212B
SHA256 e7e68debc7d12c746d1a47a3bfb9c57a2b80ec21d4ace0a52abf5c202d47d20b
MD5 266e97f5bd2d20761103af49b57f18c0
SHA1 a74ceaf3dbf6ef2cee256e07163b8751e31b36f8
SHA512 5a65fd3c6d32ad82b32b7f5169eda06be27b4f0715ccca56d05279c0bb324711a6c7d8b89bbe2a850befec5b4ea0e2631fda0d3d286f8cc4c3285fcb63f4fd82
MD5 SHA1 SHA512

Submit Download

Network.exe

Path C:\Program Files\Common Files\microsoft shared\MSInfo\Network.exe
Size 322KB
SHA256 9c5e640f0e7790f959a9350e4f926986eb3468d1b7ebdc3a2b05cc61b89d891e
MD5 1bd8aa91822bbf33deb57642ee994cca
SHA1 7077daa975365704a5d33ed0846635340af2a8df
SHA512 ea6c29713cddfa401113621d33efeab67f7568f3593cad22b6262a2e91d0f76c413ee51511b9edba1736200b4b1329ef26cc80be65b622092f3d6a2686462a6f
SSDEEP 6144:HXaZkaxUyVhPj2rAqVFWWQMHhoj5jmdHbtmVFnMFJUxJl01:HXaZk6LL8VFzHo1jCbtmHMDZ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2388-0-0x0000000000400000-0x000000000051A02E-memory.dmp

Download

memory/2388-1-0x0000000000400000-0x000000000051A02E-memory.dmp

Download

memory/2388-2-0x00000000023C0000-0x00000000023C1000-memory.dmp

Download

memory/2388-16-0x0000000000400000-0x000000000051A02E-memory.dmp

Download

memory/4336-8-0x0000000002190000-0x0000000002191000-memory.dmp

Download

memory/4336-14-0x0000000000400000-0x000000000051A02E-memory.dmp

Download

memory/4644-11-0x0000000000400000-0x000000000051B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads