modiloader | 29897313c5509cbaf181e74f29209100d1ef8dc2d9ac9912baf055ecf53c3c48

General

Target

d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118.exe
Size

280KB
MD5

d2ab0dd4e841d5ae967f173cf7b84c2c
SHA1

96a17210f2404f0f39933c9bf6ed886805c89838
SHA256

29897313c5509cbaf181e74f29209100d1ef8dc2d9ac9912baf055ecf53c3c48
SHA512

dd4d28ea13838d4c7be9b165a6a2740aa865a256b90e44f6952bf81b07e651b2850870d490fb1d793ce84d72fa70ca950b5a02abf04897298ccb5fddf027a14c
SSDEEP

3072:rO86IPZVbf8mMpML3A8XKzd9rpOiG3bwapcDebvVSQXMmdb2fDevpaHzbbr0Z:p6Irb0jQRaxCSaAEPMkAbbE

Score

10^/10

modiloader discovery evasion trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	timer.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\windows\system32\timer.exe = "C:\\windows\\system32\\timer.exe:*:Enabled:timer"	timer.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\windows\system\iexplore.exe = "C:\\windows\\system\\iexplore.exe:*:Enabled:iexplore"	timer.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\windows\system\svchost.exe = "C:\\windows\\system\\svchost.exe:*:Enabled:iexplore"	timer.exe

ModiLoader Second Stage 18 IoCs

resource	yara_rule
behavioral1/files/0x0008000000016c81-5.dat	modiloader_stage2
behavioral1/memory/2388-15-0x0000000000400000-0x0000000000446000-memory.dmp	modiloader_stage2
behavioral1/files/0x0009000000016db3-30.dat	modiloader_stage2
behavioral1/memory/2876-34-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2
behavioral1/memory/2756-36-0x0000000000400000-0x000000000040D000-memory.dmp	modiloader_stage2
behavioral1/memory/2756-38-0x0000000000400000-0x000000000040D000-memory.dmp	modiloader_stage2
behavioral1/memory/2756-40-0x0000000000400000-0x000000000040D000-memory.dmp	modiloader_stage2
behavioral1/memory/2756-42-0x0000000000400000-0x000000000040D000-memory.dmp	modiloader_stage2
behavioral1/memory/2756-44-0x0000000000400000-0x000000000040D000-memory.dmp	modiloader_stage2
behavioral1/memory/2756-46-0x0000000000400000-0x000000000040D000-memory.dmp	modiloader_stage2
behavioral1/memory/2756-48-0x0000000000400000-0x000000000040D000-memory.dmp	modiloader_stage2
behavioral1/memory/2756-50-0x0000000000400000-0x000000000040D000-memory.dmp	modiloader_stage2
behavioral1/memory/2756-52-0x0000000000400000-0x000000000040D000-memory.dmp	modiloader_stage2
behavioral1/memory/2756-57-0x0000000000400000-0x000000000040D000-memory.dmp	modiloader_stage2
behavioral1/memory/2756-73-0x0000000000400000-0x000000000040D000-memory.dmp	modiloader_stage2
behavioral1/memory/2756-75-0x0000000000400000-0x000000000040D000-memory.dmp	modiloader_stage2
behavioral1/memory/2756-77-0x0000000000400000-0x000000000040D000-memory.dmp	modiloader_stage2
behavioral1/memory/2756-79-0x0000000000400000-0x000000000040D000-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

pid	Process
2876	timer.exe
2756	comctl32.exe

Loads dropped DLL 4 IoCs

pid	Process
2388	d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118.exe
2388	d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118.exe
2876	timer.exe
2876	timer.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\timer.exe	d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\shdocvwc.dll	timer.exe
File created	C:\Windows\SysWOW64\comctl32.exe	timer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\cth.hlp	comctl32.exe
File opened for modification	C:\Windows\cth.hlp	comctl32.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File created	C:\Windows\system\svchost.exe	timer.exe
File created	C:\Windows\system\iexplore.exe	timer.exe
File created	C:\Windows\system\mscom32dll.exe	timer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F139E961-B907-11D0-B8FA-A85800C1000A}\InProcServer32\ThreadingModel = "Apartment"	timer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F139E961-B907-11D0-B8FA-A85800C1000A}\InProcServer32	timer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	timer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	timer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F139E961-B907-11D0-B8FA-A85800C1000A}	timer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F139E961-B907-11D0-B8FA-A85800C1000A}\InProcServer32\ = "shdocvwc.dll"	timer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2100	WINWORD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2756	comctl32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2100	WINWORD.EXE
2100	WINWORD.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2876	2388	d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118.exe	30
PID 2388 wrote to memory of 2876	2388	d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118.exe	30
PID 2388 wrote to memory of 2876	2388	d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118.exe	30
PID 2388 wrote to memory of 2876	2388	d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118.exe	30
PID 2388 wrote to memory of 2100	2388	d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118.exe	31
PID 2388 wrote to memory of 2100	2388	d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118.exe	31
PID 2388 wrote to memory of 2100	2388	d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118.exe	31
PID 2388 wrote to memory of 2100	2388	d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118.exe	31
PID 2876 wrote to memory of 2756	2876	timer.exe	32
PID 2876 wrote to memory of 2756	2876	timer.exe	32
PID 2876 wrote to memory of 2756	2876	timer.exe	32
PID 2876 wrote to memory of 2756	2876	timer.exe	32
PID 2100 wrote to memory of 2632	2100	WINWORD.EXE	34
PID 2100 wrote to memory of 2632	2100	WINWORD.EXE	34
PID 2100 wrote to memory of 2632	2100	WINWORD.EXE	34
PID 2100 wrote to memory of 2632	2100	WINWORD.EXE	34

C:\Users\Admin\AppData\Local\Temp\d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d2ab0dd4e841d5ae967f173cf7b84c2c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\timer.exe
  "C:\Windows\system32\timer.exe"
  2⤵
  - Modifies firewall policy service
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\SysWOW64\comctl32.exe
    C:\Windows\system32\comctl32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2756
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\selling pre-contract.doc"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\selling pre-contract.doc

Filesize
28KB

MD5
579f62549f9389364bdc9e7dcba5021c

SHA1
63874f4d93757d06ed6d836c01f602d8ea18884d

SHA256
cc40e68e243e6ca29213a12100b96970a91ecda7f71c96d7b9b2bfbf67192c8b

SHA512
df586884bcc0103752907f79ca3c06df4efe8d05165fa68660b869d30e728eb33592b6d81eacdf6d7fecd9f967ae9151972376d5dea4539aefa4d61874b9767e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
dee984f6064ba7dab2adba21d910caae

SHA1
cc6cb1f6d8185517f54b43dedc06c29b32bc6530

SHA256
890d23e472705df3067d2f26326de87a5e83c9c33f6573bdc01953a5c7ba182f

SHA512
42e5884108f851c95e2125997fd4764cc5ab1f99a85ac129c9e10bce84114043d15634400918c59d5a11c5ea5fca759c02b21123d189b9d49e11cf50cf012ba5

Download Submit
C:\Windows\SysWOW64\comctl32.exe

Filesize
22KB

MD5
9c7e74c1bc61821e6f30b72a605a33d4

SHA1
9079f466dcb6f1709a673e0a4366f12b9d459346

SHA256
8672c1759c07240a3059ec8f532100742d0efbf2cff9525195b5ba4e872bfbac

SHA512
5ce4bcc434a24554da2d57806d5d11e55f1dd2866c670e5d27b1066456f0acc36651ab83b2536791c422bec0525f2437dae757b2c68b72652d0ba2dcfdbdb466

Download Submit
\Windows\SysWOW64\timer.exe

Filesize
212KB

MD5
bc8f48263f7be653d411fa581acdbfee

SHA1
3b8d476b198f68944abafd6abad9b6fadd67f795

SHA256
c5ac33b71ce991bf856b2425ae08329d8bb597d288af1fa9dd125a16dde9614b

SHA512
4fa822dac34a5ea04c3626f59e8a2303a54f990735138c565c50dafb65cf1f3643e99caf145e6bd00f1dace2e1bea3d9396b72a9dbc52d2c14b6e24b658f6388

Download Submit
memory/2100-16-0x000000002F331000-0x000000002F332000-memory.dmp

Filesize
4KB

Download
memory/2100-18-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2100-20-0x0000000070AAD000-0x0000000070AB8000-memory.dmp

Filesize
44KB

Download
memory/2100-70-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2100-35-0x0000000070AAD000-0x0000000070AB8000-memory.dmp

Filesize
44KB

Download
memory/2388-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2756-42-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2756-52-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2756-38-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2756-44-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2756-46-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2756-48-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2756-50-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2756-40-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2756-57-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2756-36-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2756-79-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2756-73-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2756-75-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2756-77-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2876-34-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads