modiloader | ac21126325bbfba8dc6ec395e65d66d19e809c9a75171b3da1598b328af61b42

General

Target

dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
Size

302KB
MD5

dd1d34b30c320a3fa73ea1aaa242179d
SHA1

54c157c01970852b7a088c5a82e881671d5c6583
SHA256

ac21126325bbfba8dc6ec395e65d66d19e809c9a75171b3da1598b328af61b42
SHA512

27d48385f3e9c276b3697478456c904ef7c579b3888d8d50a0c45beca137d43b6c7ac33e6ce06a63bbd9c799e43be48dde55bd9d1627e4b2d45e3cef2131fa67
SSDEEP

6144:tu0YFrINLq7aBA4e6mIEadPqlE4ThK9dj7382lQAFTIVM/itVl9gjyYeciJ8u:TYFrINLPBVzn8k9dnRIV88VlGjY98

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral1/memory/1560-29-0x0000000000400000-0x0000000000561000-memory.dmp	modiloader_stage2
behavioral1/memory/2672-38-0x0000000000400000-0x0000000000561000-memory.dmp	modiloader_stage2
behavioral1/memory/1560-46-0x0000000000400000-0x0000000000561000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
2832	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2672	gb32.exe

Loads dropped DLL 5 IoCs

pid	Process
1560	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
1560	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\M:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\N:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\O:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\T:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\V:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\X:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\Z:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\B:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\E:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\P:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\R:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\K:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\Y:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\L:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\Q:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\S:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\U:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\A:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\G:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\H:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\J:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened (read-only)	\??\W:	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\AutoRun.inf	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened for modification	C:\AutoRun.inf	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File created	F:\AutoRun.inf	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File opened for modification	F:\AutoRun.inf	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_gb32.exe	gb32.exe
File opened for modification	C:\Windows\SysWOW64\_gb32.exe	gb32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2672 set thread context of 2676	2672	gb32.exe	32

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\gb32.exe	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\gb32.exe	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2576	2672	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2672	1560	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe	31
PID 1560 wrote to memory of 2672	1560	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe	31
PID 1560 wrote to memory of 2672	1560	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe	31
PID 1560 wrote to memory of 2672	1560	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe	31
PID 2672 wrote to memory of 2676	2672	gb32.exe	32
PID 2672 wrote to memory of 2676	2672	gb32.exe	32
PID 2672 wrote to memory of 2676	2672	gb32.exe	32
PID 2672 wrote to memory of 2676	2672	gb32.exe	32
PID 2672 wrote to memory of 2676	2672	gb32.exe	32
PID 2672 wrote to memory of 2676	2672	gb32.exe	32
PID 2672 wrote to memory of 2576	2672	gb32.exe	33
PID 2672 wrote to memory of 2576	2672	gb32.exe	33
PID 2672 wrote to memory of 2576	2672	gb32.exe	33
PID 2672 wrote to memory of 2576	2672	gb32.exe	33
PID 1560 wrote to memory of 2832	1560	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe	34
PID 1560 wrote to memory of 2832	1560	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe	34
PID 1560 wrote to memory of 2832	1560	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe	34
PID 1560 wrote to memory of 2832	1560	dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe	34

C:\Users\Admin\AppData\Local\Temp\dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dd1d34b30c320a3fa73ea1aaa242179d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\gb32.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\gb32.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:2676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 280
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2576
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat""
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSInfo\DelSvel.bat

Filesize
212B

MD5
cc3c169dccd94726fc88c848a5fb2890

SHA1
602d9b1a20f77c4a81a8dfc6d7d05ff2712dd657

SHA256
2cb3db1c56919ea71cedcef43ec326a20477069f96e499c1bf42b9caa2a7d89a

SHA512
01b0371dfdf3972316c114060ce252f13fb90c4b475bf8b40985b056118a4b8ae062e6b92bbdb81c5f04f4de25c3b0a9e7cc49dc2cd3577c2d7194bdbd78d7cf

Download Submit
F:\gb32.exe

Filesize
302KB

MD5
dd1d34b30c320a3fa73ea1aaa242179d

SHA1
54c157c01970852b7a088c5a82e881671d5c6583

SHA256
ac21126325bbfba8dc6ec395e65d66d19e809c9a75171b3da1598b328af61b42

SHA512
27d48385f3e9c276b3697478456c904ef7c579b3888d8d50a0c45beca137d43b6c7ac33e6ce06a63bbd9c799e43be48dde55bd9d1627e4b2d45e3cef2131fa67

Download Submit
memory/1560-20-0x0000000002F60000-0x00000000030C1000-memory.dmp

Filesize
1.4MB

Download
memory/1560-2-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1560-19-0x0000000002F60000-0x00000000030C1000-memory.dmp

Filesize
1.4MB

Download
memory/1560-0-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1560-29-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/1560-37-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1560-1-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1560-46-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2672-22-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2672-30-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2672-38-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2676-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2676-32-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads