modiloader | 9e9b767a345a46d7134ae1fc8610c1511af194dabacf97e0185cf23834840dca

General

Target

d0813b9805955116f5d02488f61e0cfc_JaffaCakes118.exe
Size

83KB
MD5

d0813b9805955116f5d02488f61e0cfc
SHA1

85f61996bba8960215a14fbaf81caf001ed95474
SHA256

9e9b767a345a46d7134ae1fc8610c1511af194dabacf97e0185cf23834840dca
SHA512

64d548040d02bc21c61ea5824f145fb09d26c3663b8ac6e5f20528bd3b924ff620bac6f7577ce7a96abce211682685d75092ffc1e78b7ff8661ef41e51d0b9c2
SSDEEP

768:iQDpqWQ9cdnjWgre+icVLk9gVMJ4RnSznofBh8v85ra47mYg:PpqWQMnFtRLk9gxnKnofBFrr7mYg

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral2/memory/5020-0-0x0000000013140000-0x0000000013158000-memory.dmp	modiloader_stage2
behavioral2/memory/5020-1-0x0000000013140000-0x0000000013158000-memory.dmp	modiloader_stage2
behavioral2/memory/5020-27-0x0000000013140000-0x0000000013158000-memory.dmp	modiloader_stage2

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ASEFVFGT.bat	d0813b9805955116f5d02488f61e0cfc_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0813b9805955116f5d02488f61e0cfc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 21 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C5C10184-6C98-11EF-B1C5-C61537EC8B44} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5020	d0813b9805955116f5d02488f61e0cfc_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3232	IEXPLORE.EXE
3232	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3232	IEXPLORE.EXE
3232	IEXPLORE.EXE
3544	IEXPLORE.EXE
3544	IEXPLORE.EXE
3232	IEXPLORE.EXE
3232	IEXPLORE.EXE
1496	IEXPLORE.EXE
1496	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 3232	5020	d0813b9805955116f5d02488f61e0cfc_JaffaCakes118.exe	87
PID 5020 wrote to memory of 3232	5020	d0813b9805955116f5d02488f61e0cfc_JaffaCakes118.exe	87
PID 3232 wrote to memory of 3544	3232	IEXPLORE.EXE	88
PID 3232 wrote to memory of 3544	3232	IEXPLORE.EXE	88
PID 3232 wrote to memory of 3544	3232	IEXPLORE.EXE	88
PID 5020 wrote to memory of 4088	5020	d0813b9805955116f5d02488f61e0cfc_JaffaCakes118.exe	89
PID 5020 wrote to memory of 4088	5020	d0813b9805955116f5d02488f61e0cfc_JaffaCakes118.exe	89
PID 3232 wrote to memory of 1496	3232	IEXPLORE.EXE	90
PID 3232 wrote to memory of 1496	3232	IEXPLORE.EXE	90
PID 3232 wrote to memory of 1496	3232	IEXPLORE.EXE	90
PID 5020 wrote to memory of 4000	5020	d0813b9805955116f5d02488f61e0cfc_JaffaCakes118.exe	93
PID 5020 wrote to memory of 4000	5020	d0813b9805955116f5d02488f61e0cfc_JaffaCakes118.exe	93
PID 5020 wrote to memory of 4000	5020	d0813b9805955116f5d02488f61e0cfc_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\d0813b9805955116f5d02488f61e0cfc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d0813b9805955116f5d02488f61e0cfc_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  open http://www.baiduuo.cn//tj.htm
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3232 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3544
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3232 CREDAT:17414 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1496
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  open http://www.baiduuo.cn//tj.htm
  2⤵
  - Modifies Internet Explorer settings
  PID:4088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\ASEFVFGT.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3HDB1LPD\common[1].js

Filesize
1KB

MD5
f900707ba51493a8951de1380dd9d6f9

SHA1
c729ed1aeb4ca40c40f44fdd246df9ed985d2852

SHA256
8a328ff2a53e340fc763d6073ffc54e3e57b3c29a461abff23557bd39ce423ba

SHA512
159bc5fed951b6ef5a9ff39bb465db237b651b72b083d895282427f91b60376f6c619ab63fbb83bf50bd080b6dcc3df8a975106265856706431566bdfb2bcce1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5JGBC19U\tj[1].js

Filesize
258B

MD5
e7a6860a1cad7a8fcd5f92a827d2c58f

SHA1
66df7ac64677b99cd979177d84f9ed73461ea9e3

SHA256
3b5969a790a91d61be39a06cb4667b2f53e96f08aae8b0a50304a9daf202137d

SHA512
6edd594f61c110a60848ce67742975f35d8a71f5596dca09f9293fe99d51a689a35b737c69ade18754076e17bc5f12e3763af8fc7040d9292d8dd01f57c34140

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IFM58U6K\tj[1].htm

Filesize
805B

MD5
228bc7c17d3f589de8c37bd3f4ef722f

SHA1
623a0a90e817b99e03750647b9b5dc7c48312939

SHA256
c91459566651b04e89be87e9bb8a27ce573dc0b55e224292b819ea5cb7a651e1

SHA512
73ddcaba3abc8e1d650f311427de48bc0dbc1d66f542710387f9d12e0c7a1254b203d2b42ba0b909834eed3ceb619fed554ba386c5564eeaaa03748a54c8a1bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\~06.tmp

Filesize
10KB

MD5
1b041b89de8730ce73a81ca00bd4396f

SHA1
7a987eec8d58bb26d30ab48b3a81c78f89410cdc

SHA256
5b9109d0adf77e886f40f3f28ab12caa4253ec2ad79b886eaca45a88fee98225

SHA512
247e6614f1c81ae11e111fe6b8f6f3acb415253bb5a4e13cf9700effc020a32c7d4148eb86cc77cf492175427edc12d20e1ec919e5134fd777fe7d7085d6a940

Download Submit
C:\Windows\SysWOW64\ASEFVFGT.bat

Filesize
212B

MD5
63cea27f18d47f9a108cbc11500b58b4

SHA1
41aa957a73099308b7f10c8e02d0b3cd26b55b78

SHA256
9bdf266348ab577431a1c3403fd8948a6a6dfb250c2b69a3c0d1664f26dec48f

SHA512
4ac132c853f21dc218971b5ce50e78573e9de09382efe1c3983af92490959a56e0aa4aefd9b0d03a1704e1fdc8c5fb9839437e5fa8d04f9709f7be95b3d075ec

Download Submit
memory/5020-0-0x0000000013140000-0x0000000013158000-memory.dmp

Filesize
96KB

Download
memory/5020-1-0x0000000013140000-0x0000000013158000-memory.dmp

Filesize
96KB

Download
memory/5020-27-0x0000000013140000-0x0000000013158000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing