modiloader | 479c0addb9eac7d4f5db9df8932724c68b9edd07e3a62d3aac4692606d2266f7

General

Target

9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe
Size

886KB
MD5

9436f16cd747610be4d4f0f1b8d6461c
SHA1

d943722404f4616413d1bc7c7466e29c0670b78a
SHA256

479c0addb9eac7d4f5db9df8932724c68b9edd07e3a62d3aac4692606d2266f7
SHA512

9c1bdc6f1c9f6b2fd76655c344aa3f1720b630bd7bf905c48328d44e3a01fb13e36118c5bfbc94053be56cbb282cf17826f82d819aa2adff18c37ab8e7a91dde
SSDEEP

12288:iWgL7QL3RwSkCT5Gxx9g/XwA+QTQQH1iaPbHiF3Z4mxxCskNPDRXLwHI:iX7QL3aCTYxx6RQQH1zCQmXCskZDRXLr

Score

10^/10

modiloader defense_evasion discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2524-40-0x0000000020000000-0x00000000200E7000-memory.dmp	modiloader_stage2

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\svchost\Parameters\ServiceDll = "C:\\Windows\\system32\\svchost.dll"	9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2824	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2076	svchost.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svchost.dll	9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\svchost.dll	9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2524 set thread context of 3016	2524	9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe	30

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 3016	2524	9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe	30
PID 2524 wrote to memory of 3016	2524	9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe	30
PID 2524 wrote to memory of 3016	2524	9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe	30
PID 2524 wrote to memory of 3016	2524	9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe	30
PID 2524 wrote to memory of 3016	2524	9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe	30
PID 2524 wrote to memory of 3016	2524	9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe	30
PID 3016 wrote to memory of 2824	3016	9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe	32
PID 3016 wrote to memory of 2824	3016	9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe	32
PID 3016 wrote to memory of 2824	3016	9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe	32
PID 3016 wrote to memory of 2824	3016	9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118.exe"
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:2824

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\svchost.dll

Filesize
526KB

MD5
1861052eae361f348cd8a52248c20608

SHA1
4f98b8ee08f300e5f1876f05f38afd4ccd26159c

SHA256
193b2b7b4abc2f78456aec0c7593aa97b51730dfbe57f70ca984c66ed0434ed1

SHA512
496d79a48d807e089c6d2807fd2ee5ea2755c9c460a72f1ac19a4c40df0eca15de5f5a983f016465e7c3b880239bab886f44a23c7f94b9960388c1714d58475c

Download Submit
memory/2076-46-0x0000000000500000-0x000000000058B000-memory.dmp

Filesize
556KB

Download
memory/2076-44-0x0000000000500000-0x000000000058B000-memory.dmp

Filesize
556KB

Download
memory/2524-15-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/2524-14-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2524-40-0x0000000020000000-0x00000000200E7000-memory.dmp

Filesize
924KB

Download
memory/2524-39-0x0000000000280000-0x00000000002D4000-memory.dmp

Filesize
336KB

Download
memory/2524-1-0x0000000000280000-0x00000000002D4000-memory.dmp

Filesize
336KB

Download
memory/2524-2-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2524-10-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/2524-11-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/2524-12-0x0000000000450000-0x0000000000451000-memory.dmp

Filesize
4KB

Download
memory/2524-27-0x0000000003500000-0x00000000035E7000-memory.dmp

Filesize
924KB

Download
memory/2524-26-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2524-25-0x0000000003180000-0x0000000003181000-memory.dmp

Filesize
4KB

Download
memory/2524-24-0x0000000003190000-0x0000000003191000-memory.dmp

Filesize
4KB

Download
memory/2524-23-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/2524-13-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2524-20-0x0000000003110000-0x0000000003111000-memory.dmp

Filesize
4KB

Download
memory/2524-18-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2524-19-0x0000000003120000-0x0000000003121000-memory.dmp

Filesize
4KB

Download
memory/2524-21-0x00000000031A0000-0x00000000031A1000-memory.dmp

Filesize
4KB

Download
memory/2524-17-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/2524-16-0x0000000000430000-0x0000000000431000-memory.dmp

Filesize
4KB

Download
memory/2524-0-0x0000000020000000-0x00000000200E7000-memory.dmp

Filesize
924KB

Download
memory/2524-22-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/3016-41-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3016-28-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3016-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3016-32-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3016-34-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3016-33-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3016-45-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3016-38-0x0000000020000000-0x00000000200E7000-memory.dmp

Filesize
924KB

Download

Analysis

Sharing