modiloader | fb54e212267f477a181b828ead70b1c74dfae41b0125aaadb032dac6f00db144

General

Target

e4275965a24f0e0cf7e83c07007a75de_JaffaCakes118.exe
Size

60KB
MD5

e4275965a24f0e0cf7e83c07007a75de
SHA1

58c6575f9916ce9744feb5a277899b510a003a79
SHA256

fb54e212267f477a181b828ead70b1c74dfae41b0125aaadb032dac6f00db144
SHA512

9ede2077cb0418ee1e46b2cc2f90409652fa2377e77469f8794838cf425edf919c722a854d9fe65ec956456e3499e7c7ce989c2570da2d626a3502708dcdeea3
SSDEEP

1536:km7wjsVTJ+p3JrkGLawHE/E2j+Ei+Hj2aBzybXNEH8ocdVcT:P+sVT45mn/bjni8DBebXNA8oucT

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/4848-3-0x0000000000400000-0x000000000042102F-memory.dmp	modiloader_stage2
behavioral2/files/0x00090000000233f5-5.dat	modiloader_stage2

Executes dropped EXE 2 IoCs

pid	Process
2404	temp.exe
2876	tcpip.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\tcpip.exe	temp.exe
File created	C:\Windows\SysWOW64\bbbbbbbbbbb.bat	temp.exe
File created	C:\Windows\SysWOW64\wwinsystem.dll	tcpip.exe
File created	C:\Windows\SysWOW64\tcpip.exe	temp.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4275965a24f0e0cf7e83c07007a75de_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tcpip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4848	e4275965a24f0e0cf7e83c07007a75de_JaffaCakes118.exe
4848	e4275965a24f0e0cf7e83c07007a75de_JaffaCakes118.exe
4848	e4275965a24f0e0cf7e83c07007a75de_JaffaCakes118.exe
4848	e4275965a24f0e0cf7e83c07007a75de_JaffaCakes118.exe
2404	temp.exe
2404	temp.exe
2404	temp.exe
2404	temp.exe
2404	temp.exe
2404	temp.exe
2404	temp.exe
2404	temp.exe
2876	tcpip.exe
2876	tcpip.exe
2876	tcpip.exe
2876	tcpip.exe
2876	tcpip.exe
2876	tcpip.exe
2876	tcpip.exe
2876	tcpip.exe
2404	temp.exe
2404	temp.exe
2404	temp.exe
2404	temp.exe
2404	temp.exe
2404	temp.exe
2404	temp.exe
2404	temp.exe
2876	tcpip.exe
2876	tcpip.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	temp.exe
Token: SeDebugPrivilege	2876	tcpip.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 1172	4848	e4275965a24f0e0cf7e83c07007a75de_JaffaCakes118.exe	82
PID 4848 wrote to memory of 1172	4848	e4275965a24f0e0cf7e83c07007a75de_JaffaCakes118.exe	82
PID 4848 wrote to memory of 1172	4848	e4275965a24f0e0cf7e83c07007a75de_JaffaCakes118.exe	82
PID 1172 wrote to memory of 2404	1172	cmd.exe	84
PID 1172 wrote to memory of 2404	1172	cmd.exe	84
PID 1172 wrote to memory of 2404	1172	cmd.exe	84
PID 2404 wrote to memory of 4916	2404	temp.exe	86
PID 2404 wrote to memory of 4916	2404	temp.exe	86
PID 2404 wrote to memory of 4916	2404	temp.exe	86
PID 2876 wrote to memory of 3472	2876	tcpip.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3472
- C:\Users\Admin\AppData\Local\Temp\e4275965a24f0e0cf7e83c07007a75de_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e4275965a24f0e0cf7e83c07007a75de_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\temp.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\Users\Admin\AppData\Local\Temp\temp.exe
      C:\Users\Admin\AppData\Local\Temp\temp.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2404
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\bbbbbbbbbbb.bat
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4916

C:\Windows\SysWOW64\tcpip.exe
C:\Windows\SysWOW64\tcpip.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\temp.exe

Filesize
44KB

MD5
bda4f4b573fb32fe2b1615a0e058c9e8

SHA1
12584195baedc79d20a8d3324a67f76f199d1e4b

SHA256
c795b88d9238d7d65057d5d054144dc51d0143cb7dd86fbddc75011306e898af

SHA512
357648aebdafa699d372ff18da62f0eab2e494312f48f2954f1b381cba99b1109b6c24955a6c8fa905ecae9534a3393dfad379f7782d92150af372556ea121d7

Download Submit
C:\Windows\SysWOW64\bbbbbbbbbbb.bat

Filesize
142B

MD5
53c15f9d357cfc1f0225894d022d38a0

SHA1
8072a611daf361d643d68d541a7201b7b9deda61

SHA256
6addadfa58eb068cc0d7a34fd225855168a1efc7e52ca6a6400c12b1a492f274

SHA512
5dfa29e8fca646e0faadf4632e301be4918d256e7a9713f689b3d082ca2922843d12bad825516f02916b2405e1741a08bd8cb1944880ded175271b5f2541e407

Download Submit
memory/4848-0-0x0000000000400000-0x000000000042102F-memory.dmp

Filesize
132KB

Download
memory/4848-3-0x0000000000400000-0x000000000042102F-memory.dmp

Filesize
132KB

Download

Analysis

Sharing