modiloader | 5b267beddbbcf86badd963dbd3d1748aea280ab2cd1a58c9adfcf02b6c2810cc

General

Target

d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe
Size

513KB
MD5

d4014a48378643071386cd74e1a87c5e
SHA1

b4fd60196d2ddb45450ec4adb01318c493759ec0
SHA256

5b267beddbbcf86badd963dbd3d1748aea280ab2cd1a58c9adfcf02b6c2810cc
SHA512

21c5563ba0e3d3aa0ef8ad5fcda2c323ce65a7b30dcd66f700a85b17b0fa0d8554b3759c923dde3c1944f61bdf536dfdc63c07ef032fe7da3681bb1199641f08
SSDEEP

12288:LpJGBpGWhj148W37dC0MKCrKHknjhHM3WPCZHBkNGJs:WBPpW37AtKxkjlWWPCVB6GW

Score

10^/10

modiloader bootkit discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral1/memory/2084-46-0x0000000000400000-0x00000000004F2000-memory.dmp	modiloader_stage2
behavioral1/memory/2700-50-0x0000000000400000-0x00000000004F2000-memory.dmp	modiloader_stage2
behavioral1/memory/2084-62-0x0000000000400000-0x00000000004F2000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
1004	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2700	rejoice101.exe

Loads dropped DLL 5 IoCs

pid	Process
2084	d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe
2084	d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe
2600	WerFault.exe
2600	WerFault.exe
2600	WerFault.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe
File opened for modification	\??\PhysicalDrive0	rejoice101.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_rejoice101.exe	rejoice101.exe
File opened for modification	C:\Windows\SysWOW64\_rejoice101.exe	rejoice101.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2700 set thread context of 2812	2700	rejoice101.exe	31

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe	d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe	d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxDel.bat	d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2600	2700	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	rejoice101.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	rejoice101.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	rejoice101.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2700	2084	d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2700	2084	d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2700	2084	d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2700	2084	d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe	30
PID 2700 wrote to memory of 2812	2700	rejoice101.exe	31
PID 2700 wrote to memory of 2812	2700	rejoice101.exe	31
PID 2700 wrote to memory of 2812	2700	rejoice101.exe	31
PID 2700 wrote to memory of 2812	2700	rejoice101.exe	31
PID 2700 wrote to memory of 2812	2700	rejoice101.exe	31
PID 2700 wrote to memory of 2812	2700	rejoice101.exe	31
PID 2700 wrote to memory of 2600	2700	rejoice101.exe	32
PID 2700 wrote to memory of 2600	2700	rejoice101.exe	32
PID 2700 wrote to memory of 2600	2700	rejoice101.exe	32
PID 2700 wrote to memory of 2600	2700	rejoice101.exe	32
PID 2084 wrote to memory of 1004	2084	d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe	34
PID 2084 wrote to memory of 1004	2084	d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe	34
PID 2084 wrote to memory of 1004	2084	d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe	34
PID 2084 wrote to memory of 1004	2084	d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe	34

C:\Users\Admin\AppData\Local\Temp\d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d4014a48378643071386cd74e1a87c5e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 304
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2600
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxDel.bat""
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSInfo\SxDel.bat

Filesize
212B

MD5
6ce565e5251afb912c1483bab850b605

SHA1
8f3db2087a039d83e4aa22b09e889b5e5e28df03

SHA256
755e016131f708ce7e79b802869cd7773e92c1bce734d3243904dc587e1dafda

SHA512
48dafabd3a95ad957eb899a34e94f77b6dd7b7ab4ce8afcd938c38a402a8fbf1b2313e8497b9667772eddbb0f4089c93836a7c5046fe7204f0ff6444d9873add

Download Submit
\Program Files\Common Files\Microsoft Shared\MSInfo\rejoice101.exe

Filesize
513KB

MD5
d4014a48378643071386cd74e1a87c5e

SHA1
b4fd60196d2ddb45450ec4adb01318c493759ec0

SHA256
5b267beddbbcf86badd963dbd3d1748aea280ab2cd1a58c9adfcf02b6c2810cc

SHA512
21c5563ba0e3d3aa0ef8ad5fcda2c323ce65a7b30dcd66f700a85b17b0fa0d8554b3759c923dde3c1944f61bdf536dfdc63c07ef032fe7da3681bb1199641f08

Download Submit
memory/2084-6-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/2084-5-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/2084-20-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2084-19-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download
memory/2084-18-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2084-17-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2084-16-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

Filesize
4KB

Download
memory/2084-15-0x0000000001E70000-0x0000000001E71000-memory.dmp

Filesize
4KB

Download
memory/2084-14-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2084-13-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Filesize
4KB

Download
memory/2084-4-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/2084-11-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/2084-10-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/2084-9-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/2084-8-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/2084-7-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/2084-21-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2084-0-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2084-12-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/2084-3-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Filesize
4KB

Download
memory/2084-2-0x0000000001F90000-0x0000000001F93000-memory.dmp

Filesize
12KB

Download
memory/2084-22-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2084-63-0x00000000002A0000-0x00000000002D5000-memory.dmp

Filesize
212KB

Download
memory/2084-32-0x0000000003630000-0x0000000003722000-memory.dmp

Filesize
968KB

Download
memory/2084-31-0x0000000003630000-0x0000000003722000-memory.dmp

Filesize
968KB

Download
memory/2084-62-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2084-1-0x00000000002A0000-0x00000000002D5000-memory.dmp

Filesize
212KB

Download
memory/2084-46-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2084-47-0x00000000002A0000-0x00000000002D5000-memory.dmp

Filesize
212KB

Download
memory/2084-48-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/2700-50-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2700-34-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2812-41-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2812-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads