modiloader | ac0e5d1f233f391959f1b6cb2d2d9663d8c05cf8cfaca2eb0a548750ae26e411

General

Target

dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe
Size

358KB
MD5

dcf04c2cc7f19b59a0bdd421b4099cad
SHA1

595bc4df3cf36487566da6562565cf9797514532
SHA256

ac0e5d1f233f391959f1b6cb2d2d9663d8c05cf8cfaca2eb0a548750ae26e411
SHA512

8ca3715076ab43a30072042c13355a000ce38b37813b82bed7c4192a4670d687e5ba4576ceedb386901bf23099bd6cd6704f8d83a27c77788b485176ce559f9f
SSDEEP

6144:V1GWAE41PIEnpmDxRon0Me4FDM8iD56e1zxs1gLLoTwPvJjFi46Bg3vUR1hyrE5:VYDrAxRUdFo8QJFxEwNQ9g/wt

Score

10^/10

modiloader discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral1/files/0x0009000000019273-2.dat	modiloader_stage2
behavioral1/memory/1544-8-0x0000000000400000-0x00000000004BD490-memory.dmp	modiloader_stage2
behavioral1/memory/1688-12-0x0000000000400000-0x00000000004BD490-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

pid	Process
1544	123.EXE
1688	123.EXE

Loads dropped DLL 4 IoCs

pid	Process
2532	dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe
1544	123.EXE
2532	dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe
1688	123.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	123.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	123.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1544	2532	dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe	30
PID 2532 wrote to memory of 1544	2532	dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe	30
PID 2532 wrote to memory of 1544	2532	dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe	30
PID 2532 wrote to memory of 1544	2532	dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe	30
PID 2532 wrote to memory of 1544	2532	dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe	30
PID 2532 wrote to memory of 1544	2532	dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe	30
PID 2532 wrote to memory of 1544	2532	dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe	30
PID 2532 wrote to memory of 1688	2532	dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe	31
PID 2532 wrote to memory of 1688	2532	dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe	31
PID 2532 wrote to memory of 1688	2532	dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe	31
PID 2532 wrote to memory of 1688	2532	dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe	31
PID 2532 wrote to memory of 1688	2532	dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe	31
PID 2532 wrote to memory of 1688	2532	dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe	31
PID 2532 wrote to memory of 1688	2532	dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dcf04c2cc7f19b59a0bdd421b4099cad_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\123.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\123.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1544
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\123.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\123.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\IXP000.TMP\123.EXE

Filesize
678KB

MD5
858939387f61f4f876c7f3c7cc55bf0f

SHA1
eca0e6d3fb3a8198bbc9f4c4425498a3729974b4

SHA256
89ca76c3cee4d4a3ffc8ff162c4d3eb2fcb0acb279404c97e2f7271784e9c74d

SHA512
85f18fc6210a1cf7d37c55a29895cc6efacd1142c7804fba2e39a3ea3b323c75577f5ad5616e162d7930ff0820fec45d6fc3a51ca97440cb97e3683182eced54

Download Submit
memory/1544-8-0x0000000000400000-0x00000000004BD490-memory.dmp

Filesize
757KB

Download
memory/1688-12-0x0000000000400000-0x00000000004BD490-memory.dmp

Filesize
757KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads