modiloader | babeb60e7af54c04c0ed96760c7f2da00472fc5aafc37e14340b4ef02eb87466

General

Target

73e4e972274371570ce7a270e978d853_JaffaCakes118.exe
Size

183KB
MD5

73e4e972274371570ce7a270e978d853
SHA1

469c44a75281865db274947591b5feec7ffe069e
SHA256

babeb60e7af54c04c0ed96760c7f2da00472fc5aafc37e14340b4ef02eb87466
SHA512

1345c45e94a8eeb3a10dd2c8779122184cd5e2d2a754d14929dccd713b1b95540c3b36b757f082c346ea457b9920f5695507a09b8b8f284e945618dadf0f25b0
SSDEEP

3072:3aBQqrSTCnM4VR7eMnQzAsrS55tF5gzA1C934hc8zicUeetZQHL0bIR:yQq1M8R7aE55tCA1Ch4h1EtL

Score

10^/10

modiloader discovery trojan upx vmprotect

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2376-22-0x0000000000020000-0x0000000000030000-memory.dmp	modiloader_stage2
behavioral1/memory/2376-25-0x0000000000020000-0x0000000000030000-memory.dmp	modiloader_stage2
behavioral1/memory/2376-24-0x0000000000400000-0x0000000000413000-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

Processes:

BA0C.tmpBA2C.tmp

pid process

1980 BA0C.tmp
2376 BA2C.tmp

pid	process
1980	BA0C.tmp
2376	BA2C.tmp

Loads dropped DLL 4 IoCs

Processes:

73e4e972274371570ce7a270e978d853_JaffaCakes118.exe

pid	process
2320	73e4e972274371570ce7a270e978d853_JaffaCakes118.exe
2320	73e4e972274371570ce7a270e978d853_JaffaCakes118.exe
2320	73e4e972274371570ce7a270e978d853_JaffaCakes118.exe
2320	73e4e972274371570ce7a270e978d853_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\BA0C.tmp	upx
behavioral1/memory/1980-20-0x0000000000400000-0x000000000047F000-memory.dmp	upx
behavioral1/memory/1980-26-0x0000000000400000-0x000000000047F000-memory.dmp	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/2320-1-0x0000000000400000-0x0000000000459000-memory.dmp	vmprotect
behavioral1/memory/2320-0-0x0000000000400000-0x0000000000459000-memory.dmp	vmprotect
behavioral1/memory/2320-18-0x0000000000400000-0x0000000000459000-memory.dmp	vmprotect

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

73e4e972274371570ce7a270e978d853_JaffaCakes118.exeBA0C.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73e4e972274371570ce7a270e978d853_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BA0C.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

BA0C.tmp

pid process

1980 BA0C.tmp

pid	process
1980	BA0C.tmp

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

73e4e972274371570ce7a270e978d853_JaffaCakes118.exe

description	pid	process	target process
PID 2320 wrote to memory of 1980	2320	73e4e972274371570ce7a270e978d853_JaffaCakes118.exe	BA0C.tmp
PID 2320 wrote to memory of 1980	2320	73e4e972274371570ce7a270e978d853_JaffaCakes118.exe	BA0C.tmp
PID 2320 wrote to memory of 1980	2320	73e4e972274371570ce7a270e978d853_JaffaCakes118.exe	BA0C.tmp
PID 2320 wrote to memory of 1980	2320	73e4e972274371570ce7a270e978d853_JaffaCakes118.exe	BA0C.tmp
PID 2320 wrote to memory of 2376	2320	73e4e972274371570ce7a270e978d853_JaffaCakes118.exe	BA2C.tmp
PID 2320 wrote to memory of 2376	2320	73e4e972274371570ce7a270e978d853_JaffaCakes118.exe	BA2C.tmp
PID 2320 wrote to memory of 2376	2320	73e4e972274371570ce7a270e978d853_JaffaCakes118.exe	BA2C.tmp
PID 2320 wrote to memory of 2376	2320	73e4e972274371570ce7a270e978d853_JaffaCakes118.exe	BA2C.tmp

C:\Users\Admin\AppData\Local\Temp\73e4e972274371570ce7a270e978d853_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\73e4e972274371570ce7a270e978d853_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320

C:\Users\Admin\AppData\Local\Temp\BA0C.tmp
"C:\Users\Admin\AppData\Local\Temp\BA0C.tmp"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1980

C:\Users\Admin\AppData\Local\Temp\BA2C.tmp
"C:\Users\Admin\AppData\Local\Temp\BA2C.tmp"
2⤵
- Executes dropped EXE
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BA2C.tmp

Filesize
50KB

MD5
4ec3ccce7d32f69f4bff94eb21c12a5d

SHA1
3f9d478bfb20018aa37cadd678ff61b257e4b474

SHA256
2c581215aa45a1a0d5e4e62d4799bfa907f1c561a87e29fc08a5e783cf3ea945

SHA512
096c4127da2ca74f0c3e9d9393dcb70cd8ef9c33d0f8ce8fca527fc1ca4afea6a046f9495514b884bd23df36af2e9d75f28581ec712773c277626680799d5085

Download Submit
\Users\Admin\AppData\Local\Temp\BA0C.tmp

Filesize
83KB

MD5
6c6bceb5ac3c95a7f69eb3da575350e0

SHA1
5ca9340e8612943220ac4157e149502342ddce2d

SHA256
812af6be81997e932bec19e9e084712c8cd301a1e0859c60930f9def803c2a12

SHA512
6a512f9a12d132684b97aa9a2674385817cab2d84cb5a3271605c9ed436de55198479f43b06998008470a1a1031dd11a09e99cac194b490a39e7751f5d11c18b

Download Submit
memory/1980-20-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1980-26-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2320-1-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2320-0-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2320-5-0x0000000000540000-0x00000000005BF000-memory.dmp

Filesize
508KB

Download
memory/2320-18-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2376-22-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/2376-25-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/2376-24-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads