modiloader | 6728e447c999448bbc69b4dccef1173639055a15a9557d535cc848d57e7370e5

General

Target

e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe
Size

1.3MB
MD5

e4352ee30a584f5e8ff32ad35aa52948
SHA1

56590a1c0d765f07b4d07620b1b499cc06666b36
SHA256

6728e447c999448bbc69b4dccef1173639055a15a9557d535cc848d57e7370e5
SHA512

3b2918f8e70f9ed111d66d8d6536fa5d9fbc6b4a9a233cba8ce46cb090abf5627a6a6bd54210fd17e949a86ff32f046c0c0dcc87519ff3fe98f4ffefde97ff71
SSDEEP

24576:UPEejaemxJieoKtkmmsppx+Sbsth0sUvqzpb+OUTE+PiZAiSrbDITf7/Q8:9EaecJt3t7n9+vtDSqIOUJaGrbDafZ

Score

10^/10

modiloader discovery evasion persistence themida trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral1/memory/1648-3-0x0000000020001000-0x0000000020003000-memory.dmp	modiloader_stage2
behavioral1/memory/1648-12-0x0000000020000000-0x000000002029B000-memory.dmp	modiloader_stage2
behavioral1/memory/1648-19-0x0000000020000000-0x000000002029B000-memory.dmp	modiloader_stage2
behavioral1/memory/1648-24-0x0000000020000000-0x000000002029B000-memory.dmp	modiloader_stage2

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\ACTIVE SETUP\INSTALLED COMPONENTS\õ?Äå,YeQ„‡þM?Þ¼ÉÚé	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\ACTIVE SETUP\INSTALLED COMPONENTS\õ?Äå,YeQ„‡þM?Þ¼ÉÚé \-ŠØ70†6’+Øü]zsIjŽYî~Ïk”cô¦¾æ[ÒÈ	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\ACTIVE SETUP\INSTALLED COMPONENTS\õ?Äå,YeQ„‡þM?Þ¼ÉÚé \-ŠØ70†6’+Øü]zsIjŽYî~Ïk”cô¦¾æ[ÒÈ\F˜lï4Ó{8Ú…Ó.—9Ë#J+ç@ë‰6!™¯Ì2ƒU™ O‰ûcÃäQ\StubPath = "C:\\Windows\\8Ú…Ó.—9Ë#J+ç@ë\b‰6!™¯Ì2ƒU™\rO‰ûcÃäQ 2"	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\ACTIVE SETUP\INSTALLED COMPONENTS\õ?Äå,YeQ„‡þM?Þ¼ÉÚé \-ŠØ70†6’+Øü]zsIjŽYî~Ïk”cô¦¾æ[ÒÈ\F˜lï4Ó{8Ú…Ó.—9Ë#J+ç@ë‰6!™¯Ì2ƒU™ O‰ûcÃäQ	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1648-0-0x0000000020000000-0x000000002029B000-memory.dmp	themida
behavioral1/memory/1648-12-0x0000000020000000-0x000000002029B000-memory.dmp	themida
behavioral1/memory/1648-19-0x0000000020000000-0x000000002029B000-memory.dmp	themida
behavioral1/memory/1648-24-0x0000000020000000-0x000000002029B000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\6!™¯Ì2ƒU™ O‰ûcÃäQ = "C:\\Windows\\8Ú…Ó.—9Ë#J+ç@ë\b‰6!™¯Ì2ƒU™\rO‰ûcÃäQ"	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCE\*6!™¯Ì2ƒU™ O‰ûcÃäQ = "C:\\Windows\\8Ú…Ó.—9Ë#J+ç@ë\b‰6!™¯Ì2ƒU™\rO‰ûcÃäQ"	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\RUNONCE\*6!™¯Ì2ƒU™ O‰ûcÃäQ = "C:\\Windows\\8Ú…Ó.—9Ë#J+ç@ë\b‰6!™¯Ì2ƒU™\rO‰ûcÃäQ"	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\6!™¯Ì2ƒU™ O‰ûcÃäQ = "C:\\Windows\\8Ú…Ó.—9Ë#J+ç@ë\b‰6!™¯Ì2ƒU™\rO‰ûcÃäQ"	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1648 set thread context of 3048	1648	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe	28

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\8Ú…Ó.—9Ë#J+ç@ë‰6!™¯Ì2ƒU™ O‰ûcÃäQ	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1648	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe
3048	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 3048	1648	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe	28
PID 1648 wrote to memory of 3048	1648	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe	28
PID 1648 wrote to memory of 3048	1648	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe	28
PID 1648 wrote to memory of 3048	1648	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe	28
PID 1648 wrote to memory of 3048	1648	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe	28
PID 1648 wrote to memory of 3048	1648	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe	28
PID 3048 wrote to memory of 1200	3048	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe	21
PID 3048 wrote to memory of 1200	3048	e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe"
  2⤵
  - Identifies Wine through registry keys
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Users\Admin\AppData\Local\Temp\e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\e4352ee30a584f5e8ff32ad35aa52948_JaffaCakes118.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Active Setup

1

T1547.014

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-19-0x0000000020000000-0x000000002029B000-memory.dmp

Filesize
2.6MB

Download
memory/1648-1-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1648-2-0x0000000000450000-0x0000000000540000-memory.dmp

Filesize
960KB

Download
memory/1648-4-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/1648-3-0x0000000020001000-0x0000000020003000-memory.dmp

Filesize
8KB

Download
memory/1648-12-0x0000000020000000-0x000000002029B000-memory.dmp

Filesize
2.6MB

Download
memory/1648-0-0x0000000020000000-0x000000002029B000-memory.dmp

Filesize
2.6MB

Download
memory/1648-24-0x0000000020000000-0x000000002029B000-memory.dmp

Filesize
2.6MB

Download
memory/3048-18-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3048-16-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3048-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3048-13-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3048-23-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads