modiloader | 9c7a344153b741cf4b0a9bc3883cb7c8c36b7e8a6cd90f3bcd634ae1870107d0

General

Target

965571411865b1b8896623b7446e9fd5_JaffaCakes118.exe
Size

284KB
MD5

965571411865b1b8896623b7446e9fd5
SHA1

cb09af5e4b973418cd095aa10b5a1b5a305f4466
SHA256

9c7a344153b741cf4b0a9bc3883cb7c8c36b7e8a6cd90f3bcd634ae1870107d0
SHA512

ac4c7528551f968630233cf762a5fdac98de2fdaf5fc79efe27b1654b9c0da45b2f49c99b479d8debce599d4a282ed0fd561cf4c226994619eda08ddce67beba
SSDEEP

6144:3dF9PEopC++PHSM+9jMQ82/YAoeIEAJm8xNjxqpTC+zj7XeqPmIgQoA06:3dF9PEcP+Py4j2/FoeIdJHyWeDPiN6

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/1584-14-0x0000000000400000-0x0000000000513000-memory.dmp	modiloader_stage2
behavioral2/memory/4040-16-0x0000000000400000-0x0000000000513000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
4040	misswe.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_misswe.exe	misswe.exe
File opened for modification	C:\Windows\SysWOW64\_misswe.exe	misswe.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\misswe.exe	965571411865b1b8896623b7446e9fd5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\misswe.exe	965571411865b1b8896623b7446e9fd5_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.bat	965571411865b1b8896623b7446e9fd5_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3176	4040	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	965571411865b1b8896623b7446e9fd5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	misswe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 4040	1584	965571411865b1b8896623b7446e9fd5_JaffaCakes118.exe	89
PID 1584 wrote to memory of 4040	1584	965571411865b1b8896623b7446e9fd5_JaffaCakes118.exe	89
PID 1584 wrote to memory of 4040	1584	965571411865b1b8896623b7446e9fd5_JaffaCakes118.exe	89
PID 4040 wrote to memory of 4888	4040	misswe.exe	90
PID 4040 wrote to memory of 4888	4040	misswe.exe	90
PID 4040 wrote to memory of 4888	4040	misswe.exe	90
PID 1584 wrote to memory of 5048	1584	965571411865b1b8896623b7446e9fd5_JaffaCakes118.exe	94
PID 1584 wrote to memory of 5048	1584	965571411865b1b8896623b7446e9fd5_JaffaCakes118.exe	94
PID 1584 wrote to memory of 5048	1584	965571411865b1b8896623b7446e9fd5_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\965571411865b1b8896623b7446e9fd5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\965571411865b1b8896623b7446e9fd5_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\misswe.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\misswe.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:4888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 648
    3⤵
    - Program crash
    PID:3176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4040 -ip 4040
1⤵
PID:3244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.bat

Filesize
212B

MD5
7f93c1da6e7f034d4885dac3772e5e9d

SHA1
f991d0f2b7b892129f70bac6a13490966c628df0

SHA256
a13b9ad84a3f07ef37d355d40710c600de16185008aef3d2af80b5df9a52248b

SHA512
f930f8885d225a26f75e181ada78782260ae0e8ff34c03d4faf726c105787ecc49a86a73057d5d08d43e21682c73343e3bc81586adfb228e9fa206775f38baa0

Download Submit
C:\Program Files\Common Files\microsoft shared\MSInfo\misswe.exe

Filesize
284KB

MD5
965571411865b1b8896623b7446e9fd5

SHA1
cb09af5e4b973418cd095aa10b5a1b5a305f4466

SHA256
9c7a344153b741cf4b0a9bc3883cb7c8c36b7e8a6cd90f3bcd634ae1870107d0

SHA512
ac4c7528551f968630233cf762a5fdac98de2fdaf5fc79efe27b1654b9c0da45b2f49c99b479d8debce599d4a282ed0fd561cf4c226994619eda08ddce67beba

Download Submit
memory/1584-0-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/1584-1-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/1584-2-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/1584-14-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/4040-8-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/4040-16-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing