modiloader | fdd87a4289aeb9219b93a66fc1a873ddc52104acfd659361f7bed1aac7c3b2b9

General

Target

2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
Size

284KB
MD5

2bd2fbd10d3fae7eefd18097f43ec4ce
SHA1

2ff8af2a784b18c7631bd0bce257223398c6af34
SHA256

fdd87a4289aeb9219b93a66fc1a873ddc52104acfd659361f7bed1aac7c3b2b9
SHA512

0495c1f049d77563cc33a60f6d71c700eb44f8b35433b46e785c6d41f86e73b2e435eba885ec7e894fd1c84983c1e75475ef248f2c1cf86a7ca4231a67de8cf2
SSDEEP

6144:OeHecZ0R/4xB8mXU0BESGpKjHqqNoST2orKblDk7drC/FI:7e7/4xualqStdT2or8lA7pC/FI

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 5 IoCs

resource	yara_rule
behavioral1/memory/1916-2-0x0000000000400000-0x0000000000552000-memory.dmp	modiloader_stage2
behavioral1/memory/1916-13-0x0000000000400000-0x0000000000552000-memory.dmp	modiloader_stage2
behavioral1/memory/1968-29-0x0000000000400000-0x0000000000552000-memory.dmp	modiloader_stage2
behavioral1/memory/1916-33-0x0000000000400000-0x0000000000552000-memory.dmp	modiloader_stage2
behavioral1/memory/1916-35-0x0000000000400000-0x0000000000552000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
1968	systems32.exe

Loads dropped DLL 5 IoCs

pid	Process
1916	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
1916	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
1908	WerFault.exe
1908	WerFault.exe
1908	WerFault.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\H:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\K:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\O:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\Q:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\R:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\S:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\Z:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\B:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\I:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\L:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\P:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\T:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\X:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\A:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\E:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\Y:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\G:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\J:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\M:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\N:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\U:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened (read-only)	\??\V:	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\AutoRun.inf	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened for modification	C:\AutoRun.inf	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File created	F:\AutoRun.inf	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened for modification	F:\AutoRun.inf	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_systems32.exe	systems32.exe
File opened for modification	C:\Windows\SysWOW64\_systems32.exe	systems32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\systems32.exe	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\systems32.exe	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1908	1968	WerFault.exe	28

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1968	1916	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe	28
PID 1916 wrote to memory of 1968	1916	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe	28
PID 1916 wrote to memory of 1968	1916	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe	28
PID 1916 wrote to memory of 1968	1916	2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe	28
PID 1968 wrote to memory of 1908	1968	systems32.exe	29
PID 1968 wrote to memory of 1908	1968	systems32.exe	29
PID 1968 wrote to memory of 1908	1968	systems32.exe	29
PID 1968 wrote to memory of 1908	1968	systems32.exe	29

C:\Users\Admin\AppData\Local\Temp\2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2bd2fbd10d3fae7eefd18097f43ec4ce_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\systems32.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\systems32.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 284
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F:\systems32.exe

Filesize
284KB

MD5
2bd2fbd10d3fae7eefd18097f43ec4ce

SHA1
2ff8af2a784b18c7631bd0bce257223398c6af34

SHA256
fdd87a4289aeb9219b93a66fc1a873ddc52104acfd659361f7bed1aac7c3b2b9

SHA512
0495c1f049d77563cc33a60f6d71c700eb44f8b35433b46e785c6d41f86e73b2e435eba885ec7e894fd1c84983c1e75475ef248f2c1cf86a7ca4231a67de8cf2

Download Submit
memory/1916-22-0x00000000030D0000-0x0000000003222000-memory.dmp

Filesize
1.3MB

Download
memory/1916-2-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/1916-1-0x000000000054E000-0x0000000000550000-memory.dmp

Filesize
8KB

Download
memory/1916-13-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/1916-0-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/1916-20-0x00000000030D0000-0x0000000003222000-memory.dmp

Filesize
1.3MB

Download
memory/1916-33-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/1916-34-0x000000000054E000-0x0000000000550000-memory.dmp

Filesize
8KB

Download
memory/1916-35-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/1968-23-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/1968-24-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/1968-29-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads