modiloader | 752b139eb6f1c70c9f3be4a4a39a247384be0356a6c0e7d613529aab5d934873

General

Target

3e9fc5cc1072a41bf2f22d85800638d4_JaffaCakes118.exe
Size

644KB
MD5

3e9fc5cc1072a41bf2f22d85800638d4
SHA1

27aab6ec4b11f9600c0b0444796829adf52f187f
SHA256

752b139eb6f1c70c9f3be4a4a39a247384be0356a6c0e7d613529aab5d934873
SHA512

02eb7dd1e7096c5a69742eb5db9ee547c3dc141cf888f82086f777476b1edd700725dfebc3d49f731761961ed59b8adfcb833c011126d901e2ba326be41efa15
SSDEEP

12288:ONDaP0GAEoXmls1sY0abKNm9SA8F3Z4mxxgDu8YaYr1vPqkDAm7:ONDasGAX3Z09EwlQmXgDu8YTrJ9DR

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral2/memory/4844-11-0x00000000034C0000-0x00000000035C0000-memory.dmp	modiloader_stage2
behavioral2/memory/3596-33-0x0000000000400000-0x0000000000511000-memory.dmp	modiloader_stage2
behavioral2/memory/4844-35-0x0000000000400000-0x0000000000511000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
3596	Server.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\_Server.exe	Server.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3596 set thread context of 1608	3596	Server.exe	87
PID 3596 set thread context of 5032	3596	Server.exe	88

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat	3e9fc5cc1072a41bf2f22d85800638d4_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server.exe	3e9fc5cc1072a41bf2f22d85800638d4_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server.exe	3e9fc5cc1072a41bf2f22d85800638d4_JaffaCakes118.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2972	5032	WerFault.exe	88
3264	1608	WerFault.exe	87

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 3596	4844	3e9fc5cc1072a41bf2f22d85800638d4_JaffaCakes118.exe	86
PID 4844 wrote to memory of 3596	4844	3e9fc5cc1072a41bf2f22d85800638d4_JaffaCakes118.exe	86
PID 4844 wrote to memory of 3596	4844	3e9fc5cc1072a41bf2f22d85800638d4_JaffaCakes118.exe	86
PID 3596 wrote to memory of 1608	3596	Server.exe	87
PID 3596 wrote to memory of 1608	3596	Server.exe	87
PID 3596 wrote to memory of 1608	3596	Server.exe	87
PID 3596 wrote to memory of 1608	3596	Server.exe	87
PID 3596 wrote to memory of 1608	3596	Server.exe	87
PID 3596 wrote to memory of 5032	3596	Server.exe	88
PID 3596 wrote to memory of 5032	3596	Server.exe	88
PID 3596 wrote to memory of 5032	3596	Server.exe	88
PID 3596 wrote to memory of 5032	3596	Server.exe	88
PID 3596 wrote to memory of 5032	3596	Server.exe	88
PID 4844 wrote to memory of 1292	4844	3e9fc5cc1072a41bf2f22d85800638d4_JaffaCakes118.exe	90
PID 4844 wrote to memory of 1292	4844	3e9fc5cc1072a41bf2f22d85800638d4_JaffaCakes118.exe	90
PID 4844 wrote to memory of 1292	4844	3e9fc5cc1072a41bf2f22d85800638d4_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\3e9fc5cc1072a41bf2f22d85800638d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e9fc5cc1072a41bf2f22d85800638d4_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:1608
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 12
      4⤵
      Program crash
      PID:3264
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    PID:5032
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 12
      4⤵
      Program crash
      PID:2972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat""
  2⤵
  PID:1292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5032 -ip 5032
1⤵
PID:536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1608 -ip 1608
1⤵
PID:1456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat

Filesize
212B

MD5
e60b9565bc931a6c40545673a7689745

SHA1
02b5237ae99f0a2b16837626d68f95c71552a732

SHA256
c4698ffa1a7e3b8bce882f242d41a880d286871b1fc78e1cfb55d3b8aebd330f

SHA512
357ec10fbb3101d96a89a45404da6310280715db136bec013d5c34c3db456b1724d2d37339ec0f2c6e8a721048e999b2319f93ba896e83b2ec8e7a880b18ebbf

Download Submit
C:\Program Files\Common Files\microsoft shared\MSInfo\Server.exe

Filesize
644KB

MD5
3e9fc5cc1072a41bf2f22d85800638d4

SHA1
27aab6ec4b11f9600c0b0444796829adf52f187f

SHA256
752b139eb6f1c70c9f3be4a4a39a247384be0356a6c0e7d613529aab5d934873

SHA512
02eb7dd1e7096c5a69742eb5db9ee547c3dc141cf888f82086f777476b1edd700725dfebc3d49f731761961ed59b8adfcb833c011126d901e2ba326be41efa15

Download Submit
memory/1608-27-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/3596-33-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/3596-24-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/4844-6-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/4844-16-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/4844-11-0x00000000034C0000-0x00000000035C0000-memory.dmp

Filesize
1024KB

Download
memory/4844-10-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/4844-9-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/4844-8-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/4844-7-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/4844-0-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/4844-5-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/4844-18-0x00000000034E0000-0x00000000034E1000-memory.dmp

Filesize
4KB

Download
memory/4844-17-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/4844-12-0x00000000034D0000-0x00000000034D1000-memory.dmp

Filesize
4KB

Download
memory/4844-3-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/4844-2-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/4844-13-0x00000000034C0000-0x00000000034C3000-memory.dmp

Filesize
12KB

Download
memory/4844-15-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/4844-14-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4844-4-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/4844-36-0x0000000002340000-0x0000000002394000-memory.dmp

Filesize
336KB

Download
memory/4844-35-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/4844-1-0x0000000002340000-0x0000000002394000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing