modiloader | 8d32699cfcd155b2e76799a69adf1d893197a03684bf8846ac81964d09b529cd

General

Target

cf8a88872161bfa0fa2515e8d8bc9378_JaffaCakes118.exe
Size

369KB
MD5

cf8a88872161bfa0fa2515e8d8bc9378
SHA1

befda4f9436494a2d1a80269e95978e45ba42873
SHA256

8d32699cfcd155b2e76799a69adf1d893197a03684bf8846ac81964d09b529cd
SHA512

7cbbf07d844e7a7f5e7cb9717464dfc149cbd992977a315abbe59efcfaa50f67ce4c68382bbad70e831b1bbf2db0823657f0e8509dabb73a2386e76ca41b8b25
SSDEEP

6144:Z60s8fAKCc0dM0sUDJAX0InyKsQluQolNl7Tu56dcMM3+kKebrumlW5r/PylRuK:zs8fAKj0C03A0INRErpQ6SbK5x5ryR/

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/memory/2520-23-0x0000000000400000-0x0000000000519000-memory.dmp	modiloader_stage2
behavioral1/memory/2356-24-0x0000000000400000-0x0000000000519000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
1156	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2520	Server47.exe

Loads dropped DLL 2 IoCs

pid	Process
2356	cf8a88872161bfa0fa2515e8d8bc9378_JaffaCakes118.exe
2356	cf8a88872161bfa0fa2515e8d8bc9378_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_Server47.exe	Server47.exe
File opened for modification	C:\Windows\SysWOW64\_Server47.exe	Server47.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2520 set thread context of 1788	2520	Server47.exe	32

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server47.exe	cf8a88872161bfa0fa2515e8d8bc9378_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server47.exe	cf8a88872161bfa0fa2515e8d8bc9378_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf8a88872161bfa0fa2515e8d8bc9378_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server47.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2520	2356	cf8a88872161bfa0fa2515e8d8bc9378_JaffaCakes118.exe	30
PID 2356 wrote to memory of 2520	2356	cf8a88872161bfa0fa2515e8d8bc9378_JaffaCakes118.exe	30
PID 2356 wrote to memory of 2520	2356	cf8a88872161bfa0fa2515e8d8bc9378_JaffaCakes118.exe	30
PID 2356 wrote to memory of 2520	2356	cf8a88872161bfa0fa2515e8d8bc9378_JaffaCakes118.exe	30
PID 2520 wrote to memory of 1788	2520	Server47.exe	32
PID 2520 wrote to memory of 1788	2520	Server47.exe	32
PID 2520 wrote to memory of 1788	2520	Server47.exe	32
PID 2520 wrote to memory of 1788	2520	Server47.exe	32
PID 2520 wrote to memory of 1788	2520	Server47.exe	32
PID 2520 wrote to memory of 1788	2520	Server47.exe	32
PID 2520 wrote to memory of 2032	2520	Server47.exe	33
PID 2520 wrote to memory of 2032	2520	Server47.exe	33
PID 2520 wrote to memory of 2032	2520	Server47.exe	33
PID 2520 wrote to memory of 2032	2520	Server47.exe	33
PID 2356 wrote to memory of 1156	2356	cf8a88872161bfa0fa2515e8d8bc9378_JaffaCakes118.exe	34
PID 2356 wrote to memory of 1156	2356	cf8a88872161bfa0fa2515e8d8bc9378_JaffaCakes118.exe	34
PID 2356 wrote to memory of 1156	2356	cf8a88872161bfa0fa2515e8d8bc9378_JaffaCakes118.exe	34
PID 2356 wrote to memory of 1156	2356	cf8a88872161bfa0fa2515e8d8bc9378_JaffaCakes118.exe	34

C:\Users\Admin\AppData\Local\Temp\cf8a88872161bfa0fa2515e8d8bc9378_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cf8a88872161bfa0fa2515e8d8bc9378_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server47.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server47.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:1788
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    PID:2032
- C:\Windows\SysWOW64\cmd.exe
  cmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\cf8a88872161bfa0fa2515e8d8bc9378_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\Common Files\Microsoft Shared\MSInfo\Server47.exe

Filesize
369KB

MD5
cf8a88872161bfa0fa2515e8d8bc9378

SHA1
befda4f9436494a2d1a80269e95978e45ba42873

SHA256
8d32699cfcd155b2e76799a69adf1d893197a03684bf8846ac81964d09b529cd

SHA512
7cbbf07d844e7a7f5e7cb9717464dfc149cbd992977a315abbe59efcfaa50f67ce4c68382bbad70e831b1bbf2db0823657f0e8509dabb73a2386e76ca41b8b25

Download Submit
memory/1788-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1788-21-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/2356-0-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/2356-1-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2356-2-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2356-11-0x0000000003170000-0x0000000003289000-memory.dmp

Filesize
1.1MB

Download
memory/2356-24-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/2520-14-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2520-23-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing