modiloader | 2eda0f451b72b60b6a2067887823705f0d82e9922a917ba0fc68bbaeb82000f4

General

Target

cf87449739d920d5c543b686923657a5_JaffaCakes118.exe
Size

361KB
MD5

cf87449739d920d5c543b686923657a5
SHA1

c7e7a0d6154dd1f1cbecabd9a89a51651700813b
SHA256

2eda0f451b72b60b6a2067887823705f0d82e9922a917ba0fc68bbaeb82000f4
SHA512

753f2bdf967c33ff886db60e9f36b8c2dbf683b0f146259b7425f062365af103432a080723ce8f8623bff74718c0c748e0798ee6de5b887bc447b2d83de99c5f
SSDEEP

6144:dKsFbaCSJSlQ68HmEyMtE/mG4yQHXKgk6oOlNuX80IhItoRiX/8t+1OaRj6Z03RD:dLFba/+EivO7BlhlTo/p1OaR2Z0

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral1/memory/2376-21-0x0000000000400000-0x00000000004BC000-memory.dmp	modiloader_stage2
behavioral1/memory/2960-22-0x0000000000400000-0x00000000004BC000-memory.dmp	modiloader_stage2
behavioral1/memory/2376-36-0x0000000000400000-0x00000000004BC000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
2644	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2960	Atvia.exe

Loads dropped DLL 5 IoCs

pid	Process
2376	cf87449739d920d5c543b686923657a5_JaffaCakes118.exe
2376	cf87449739d920d5c543b686923657a5_JaffaCakes118.exe
2952	WerFault.exe
2952	WerFault.exe
2952	WerFault.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\_Atvia.exe	Atvia.exe
File created	C:\Windows\SysWOW64\_Atvia.exe	Atvia.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxDel.bat	cf87449739d920d5c543b686923657a5_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Atvia.exe	cf87449739d920d5c543b686923657a5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Atvia.exe	cf87449739d920d5c543b686923657a5_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2952	2960	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Atvia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf87449739d920d5c543b686923657a5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2960	2376	cf87449739d920d5c543b686923657a5_JaffaCakes118.exe	31
PID 2376 wrote to memory of 2960	2376	cf87449739d920d5c543b686923657a5_JaffaCakes118.exe	31
PID 2376 wrote to memory of 2960	2376	cf87449739d920d5c543b686923657a5_JaffaCakes118.exe	31
PID 2376 wrote to memory of 2960	2376	cf87449739d920d5c543b686923657a5_JaffaCakes118.exe	31
PID 2960 wrote to memory of 2952	2960	Atvia.exe	32
PID 2960 wrote to memory of 2952	2960	Atvia.exe	32
PID 2960 wrote to memory of 2952	2960	Atvia.exe	32
PID 2960 wrote to memory of 2952	2960	Atvia.exe	32
PID 2376 wrote to memory of 2644	2376	cf87449739d920d5c543b686923657a5_JaffaCakes118.exe	33
PID 2376 wrote to memory of 2644	2376	cf87449739d920d5c543b686923657a5_JaffaCakes118.exe	33
PID 2376 wrote to memory of 2644	2376	cf87449739d920d5c543b686923657a5_JaffaCakes118.exe	33
PID 2376 wrote to memory of 2644	2376	cf87449739d920d5c543b686923657a5_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\cf87449739d920d5c543b686923657a5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cf87449739d920d5c543b686923657a5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\Atvia.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\Atvia.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 284
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxDel.bat""
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSInfo\SxDel.bat

Filesize
212B

MD5
5c8f3d09661ee5a4735246594b708dce

SHA1
99917a5190dac5495189e818911cfca6c2b858d4

SHA256
7d6ce731a766ace4f4cac14f1101ba4f3b8e095551a573a3549ff0715862ff99

SHA512
bdde9a0600f43b1e0466af41d4d7f1ff01686ac2d03131d91f38643524013ced2b5e3469656de1a676839d74828a04756d3e743ce80e09c0bf2c48f7ed06d37e

Download Submit
\Program Files\Common Files\Microsoft Shared\MSInfo\Atvia.exe

Filesize
361KB

MD5
cf87449739d920d5c543b686923657a5

SHA1
c7e7a0d6154dd1f1cbecabd9a89a51651700813b

SHA256
2eda0f451b72b60b6a2067887823705f0d82e9922a917ba0fc68bbaeb82000f4

SHA512
753f2bdf967c33ff886db60e9f36b8c2dbf683b0f146259b7425f062365af103432a080723ce8f8623bff74718c0c748e0798ee6de5b887bc447b2d83de99c5f

Download Submit
memory/2376-0-0x0000000000020000-0x0000000000029000-memory.dmp

Filesize
36KB

Download
memory/2376-1-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/2376-20-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/2376-21-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2376-35-0x0000000000020000-0x0000000000029000-memory.dmp

Filesize
36KB

Download
memory/2376-36-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2960-11-0x0000000000020000-0x0000000000029000-memory.dmp

Filesize
36KB

Download
memory/2960-12-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2960-23-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2960-22-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download

Analysis

Sharing