modiloader | 7185d8b69696bfcd440e7e6ca5b4a339b522f54474d99bf7fead5777765bda1f

General

Target

e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
Size

645KB
MD5

e2eb0767b3e3ef0c87555c54ddab841c
SHA1

818dd7aa721934d845ac98f347814e490b931784
SHA256

7185d8b69696bfcd440e7e6ca5b4a339b522f54474d99bf7fead5777765bda1f
SHA512

a8521e21f6e47b3865e98df6a42a640386f998c46c9ddc867139e00b1ff059635ba856c1f58f794fd923da27c617f33b2be703d36d6f8e80f542ef9f82fa10b5
SSDEEP

12288:DtrIdrxHJuOWawi+vRi+8lkQrToUF3Z4mxx/Ol+VdWrJf2:SZFJdyL8lbHoUQmXGl+/Ws

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/4616-36-0x0000000000400000-0x000000000051D000-memory.dmp	modiloader_stage2
behavioral2/memory/4428-37-0x0000000000400000-0x000000000051D000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
4616	Server.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\P:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\R:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\A:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\G:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\I:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\K:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\L:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\S:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\T:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\X:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\Y:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\Z:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\E:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\N:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\Q:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\H:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\J:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\U:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\V:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\B:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\M:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened (read-only)	\??\W:	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\AutoRun.inf	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened for modification	C:\AutoRun.inf	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File created	F:\AutoRun.inf	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened for modification	F:\AutoRun.inf	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\_Server.exe	Server.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server.exe	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server.exe	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 4616	4428	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe	82
PID 4428 wrote to memory of 4616	4428	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe	82
PID 4428 wrote to memory of 4616	4428	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe	82
PID 4616 wrote to memory of 3760	4616	Server.exe	83
PID 4616 wrote to memory of 3760	4616	Server.exe	83
PID 4616 wrote to memory of 3760	4616	Server.exe	83
PID 4616 wrote to memory of 4628	4616	Server.exe	84
PID 4616 wrote to memory of 4628	4616	Server.exe	84
PID 4428 wrote to memory of 4332	4428	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe	85
PID 4428 wrote to memory of 4332	4428	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe	85
PID 4428 wrote to memory of 4332	4428	e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e2eb0767b3e3ef0c87555c54ddab841c_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\Server.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:3760
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    PID:4628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat

Filesize
212B

MD5
074b44fc1db36bfa7ad809b50171dc56

SHA1
c9226a2c3af6bcaa06b2ded484e3c6651b521ffa

SHA256
83614bb7c238559131193a8c579b2c7576eef9a9d0aaabf60dbda62455b8453b

SHA512
03712cf5decfbfb714bdbcde0259b63ce4b406d5596e33c3a5b54bc27dd219cab9c760195aa5a6c40c702d23eb56c6c0d619336404a9c3cdbba24e4ac2223027

Download Submit
F:\Server.exe

Filesize
645KB

MD5
e2eb0767b3e3ef0c87555c54ddab841c

SHA1
818dd7aa721934d845ac98f347814e490b931784

SHA256
7185d8b69696bfcd440e7e6ca5b4a339b522f54474d99bf7fead5777765bda1f

SHA512
a8521e21f6e47b3865e98df6a42a640386f998c46c9ddc867139e00b1ff059635ba856c1f58f794fd923da27c617f33b2be703d36d6f8e80f542ef9f82fa10b5

Download Submit
memory/4428-10-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/4428-7-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/4428-14-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/4428-17-0x00000000034E0000-0x00000000034E1000-memory.dmp

Filesize
4KB

Download
memory/4428-16-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/4428-15-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4428-12-0x00000000034C0000-0x00000000034C3000-memory.dmp

Filesize
12KB

Download
memory/4428-11-0x00000000034D0000-0x00000000034D1000-memory.dmp

Filesize
4KB

Download
memory/4428-0-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/4428-9-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/4428-8-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/4428-13-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4428-6-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/4428-5-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/4428-3-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4428-2-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/4428-4-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/4428-1-0x00000000022F0000-0x0000000002344000-memory.dmp

Filesize
336KB

Download
memory/4428-38-0x00000000022F0000-0x0000000002344000-memory.dmp

Filesize
336KB

Download
memory/4428-37-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/4616-36-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads