modiloader | 23e637f7f022adc41d60825756ce07ab14384c8adf3a8ef59bcb05a1f7f94cfe

General

Target

e17f8d9173fd5f30705ba184883b6163_JaffaCakes118.exe
Size

144KB
MD5

e17f8d9173fd5f30705ba184883b6163
SHA1

ac10dc8e92306d65f6bc4052392dac409083e64e
SHA256

23e637f7f022adc41d60825756ce07ab14384c8adf3a8ef59bcb05a1f7f94cfe
SHA512

7928e259a025d3a2be88efc75ca20b20b52397f4979af63157631801615651b79d1b7509725ea55e682d07966a739827cdc37d65f708a93737f611439e3694f1
SSDEEP

1536:YCqlwmQJn6NAooqurT0GQi9SLk+3/n+P8UdNMyZ0QGM6:UIo+/9SQS/y8MeyZRI

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 6 IoCs

resource	yara_rule
behavioral1/memory/3012-1-0x0000000000400000-0x0000000000424000-memory.dmp	modiloader_stage2
behavioral1/memory/3012-9-0x0000000000850000-0x0000000000874000-memory.dmp	modiloader_stage2
behavioral1/files/0x00080000000173c8-12.dat	modiloader_stage2
behavioral1/memory/1720-15-0x0000000000400000-0x0000000000424000-memory.dmp	modiloader_stage2
behavioral1/memory/3012-20-0x0000000000400000-0x0000000000424000-memory.dmp	modiloader_stage2
behavioral1/memory/1720-22-0x0000000000400000-0x0000000000424000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
1720	sourro.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\sourro.exe	sourro.exe
File created	C:\Windows\mm	e17f8d9173fd5f30705ba184883b6163_JaffaCakes118.exe
File created	C:\Windows\qiji.dll	e17f8d9173fd5f30705ba184883b6163_JaffaCakes118.exe
File created	C:\Windows\sourro.exe	e17f8d9173fd5f30705ba184883b6163_JaffaCakes118.exe
File opened for modification	C:\Windows\sourro.exe	e17f8d9173fd5f30705ba184883b6163_JaffaCakes118.exe
File created	C:\Windows\qiji.dll	sourro.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sourro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e17f8d9173fd5f30705ba184883b6163_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	3012	e17f8d9173fd5f30705ba184883b6163_JaffaCakes118.exe
Token: SeRestorePrivilege	3012	e17f8d9173fd5f30705ba184883b6163_JaffaCakes118.exe
Token: SeBackupPrivilege	3012	e17f8d9173fd5f30705ba184883b6163_JaffaCakes118.exe
Token: SeRestorePrivilege	3012	e17f8d9173fd5f30705ba184883b6163_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1720	sourro.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1720	3012	e17f8d9173fd5f30705ba184883b6163_JaffaCakes118.exe	30
PID 3012 wrote to memory of 1720	3012	e17f8d9173fd5f30705ba184883b6163_JaffaCakes118.exe	30
PID 3012 wrote to memory of 1720	3012	e17f8d9173fd5f30705ba184883b6163_JaffaCakes118.exe	30
PID 3012 wrote to memory of 1720	3012	e17f8d9173fd5f30705ba184883b6163_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\e17f8d9173fd5f30705ba184883b6163_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e17f8d9173fd5f30705ba184883b6163_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\sourro.exe
  C:\Windows\sourro.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\qiji.dll

Filesize
28KB

MD5
99573e8262c7030c00b86377479a6fa3

SHA1
427d8e71728ed2463f4ce85ed681531c5955e35b

SHA256
455d831aeaf19d924397afc1794cf1ecd91ebe7a1c6126096109ad28cbd1b3dd

SHA512
3e07b1cb6f8ed9f2b88041e3c99a41d3b919e7fa2e332bd18c0aaaabe9911b127a14e97008acdcf14b44f1a219958b5392012e67b04280e816d90cbae32fe4fd

Download Submit
C:\Windows\sourro.exe

Filesize
144KB

MD5
e17f8d9173fd5f30705ba184883b6163

SHA1
ac10dc8e92306d65f6bc4052392dac409083e64e

SHA256
23e637f7f022adc41d60825756ce07ab14384c8adf3a8ef59bcb05a1f7f94cfe

SHA512
7928e259a025d3a2be88efc75ca20b20b52397f4979af63157631801615651b79d1b7509725ea55e682d07966a739827cdc37d65f708a93737f611439e3694f1

Download Submit
memory/1720-15-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1720-18-0x0000000000220000-0x000000000022D000-memory.dmp

Filesize
52KB

Download
memory/1720-21-0x0000000000220000-0x000000000022D000-memory.dmp

Filesize
52KB

Download
memory/1720-22-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3012-1-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3012-6-0x0000000000320000-0x000000000032D000-memory.dmp

Filesize
52KB

Download
memory/3012-9-0x0000000000850000-0x0000000000874000-memory.dmp

Filesize
144KB

Download
memory/3012-13-0x0000000000850000-0x0000000000874000-memory.dmp

Filesize
144KB

Download
memory/3012-19-0x0000000000320000-0x000000000032D000-memory.dmp

Filesize
52KB

Download
memory/3012-20-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing