modiloader | deb9eab1e0555d91f4c0b8481e53d294e9a12956307250691a18aa7a2f934f4a

General

Target

e5322a3971443460710e3146f0319aa8_JaffaCakes118.exe
Size

358KB
MD5

e5322a3971443460710e3146f0319aa8
SHA1

df58a48d6fe4f57a452a426147ea5c51e579f101
SHA256

deb9eab1e0555d91f4c0b8481e53d294e9a12956307250691a18aa7a2f934f4a
SHA512

793c681c41a30cfb19b472b9d79dd21d696aafe0bf6ebed743043787774074b1e2e285ce76c5c2d288156831d76b160d842f7c8fb0115bfb9f5aace13088da55
SSDEEP

6144:hjPei55k0QOqWhQcDtVuteJYMklofTT3zYK8Z3/28ADELSlgilQ9:hK05k0QdYLDWteJYMkl5DZP2tDELUTO9

Score

10^/10

modiloader discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral2/memory/1616-7-0x0000000000400000-0x000000000040A000-memory.dmp	modiloader_stage2
behavioral2/memory/1616-9-0x0000000000400000-0x000000000040A000-memory.dmp	modiloader_stage2
behavioral2/memory/1616-10-0x0000000000400000-0x000000000040A000-memory.dmp	modiloader_stage2
behavioral2/memory/1616-12-0x0000000000400000-0x000000000040A000-memory.dmp	modiloader_stage2

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000700000002343f-19.dat	acprotect

Executes dropped EXE 3 IoCs

pid	Process
5084	downloader.exe
1616	downloader.exe
2736	keygen.exe

Loads dropped DLL 2 IoCs

pid	Process
2736	keygen.exe
2736	keygen.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e5322a3971443460710e3146f0319aa8_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5084 set thread context of 1616	5084	downloader.exe	83

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5322a3971443460710e3146f0319aa8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	downloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2736	keygen.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 5084	4304	e5322a3971443460710e3146f0319aa8_JaffaCakes118.exe	82
PID 4304 wrote to memory of 5084	4304	e5322a3971443460710e3146f0319aa8_JaffaCakes118.exe	82
PID 4304 wrote to memory of 5084	4304	e5322a3971443460710e3146f0319aa8_JaffaCakes118.exe	82
PID 5084 wrote to memory of 1616	5084	downloader.exe	83
PID 5084 wrote to memory of 1616	5084	downloader.exe	83
PID 5084 wrote to memory of 1616	5084	downloader.exe	83
PID 5084 wrote to memory of 1616	5084	downloader.exe	83
PID 5084 wrote to memory of 1616	5084	downloader.exe	83
PID 5084 wrote to memory of 1616	5084	downloader.exe	83
PID 5084 wrote to memory of 1616	5084	downloader.exe	83
PID 5084 wrote to memory of 1616	5084	downloader.exe	83
PID 5084 wrote to memory of 1616	5084	downloader.exe	83
PID 5084 wrote to memory of 1616	5084	downloader.exe	83
PID 5084 wrote to memory of 1616	5084	downloader.exe	83
PID 5084 wrote to memory of 1616	5084	downloader.exe	83
PID 4304 wrote to memory of 2736	4304	e5322a3971443460710e3146f0319aa8_JaffaCakes118.exe	84
PID 4304 wrote to memory of 2736	4304	e5322a3971443460710e3146f0319aa8_JaffaCakes118.exe	84
PID 4304 wrote to memory of 2736	4304	e5322a3971443460710e3146f0319aa8_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\e5322a3971443460710e3146f0319aa8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e5322a3971443460710e3146f0319aa8_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\downloader.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\downloader.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\downloader.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\downloader.exe
    3⤵
    - Executes dropped EXE
    PID:1616
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\downloader.exe

Filesize
17KB

MD5
243869d14e5a9411b5ce0086602ea195

SHA1
383eb42b5e3717ddd6092ca03959385705ea2839

SHA256
c9fac0722c6eaffa1ae6d6941d2d183e457844a2808a0ca7271a8fcef08b124f

SHA512
4edecedc2908f3f390db864647158d6f6ae283542f5832d34124913ff71a45b00aab3b100e65d18f42936b1017b7b1bc3cdf5c46bbad194cba68f76ee2faaeac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\keygen.exe

Filesize
298KB

MD5
1f50463ff0be5037d9dbf09c87aa3653

SHA1
260fcc9da4f145055d83179314fb9cafe9aa53cd

SHA256
75e47dd31be7642d791bcb4496ff89e8138cfae5472f16153c8c43ba5315deed

SHA512
3be4b2c2c81a882bb68a370c64fa2915816e163ef53b0b11ee36a225effec651ae1ac9baec49ae11b867ed6ed417667af670d1cde9216f6645e7431513fa991f

Download Submit
C:\Users\Admin\AppData\Local\Temp\poi8F9D.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/1616-7-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1616-9-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1616-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1616-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2736-23-0x00000000020B0000-0x0000000002123000-memory.dmp

Filesize
460KB

Download
memory/2736-14-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2736-22-0x00000000020B0000-0x0000000002123000-memory.dmp

Filesize
460KB

Download
memory/2736-24-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2736-25-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2736-26-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2736-29-0x00000000020B0000-0x0000000002123000-memory.dmp

Filesize
460KB

Download
memory/2736-35-0x00000000020B0000-0x0000000002123000-memory.dmp

Filesize
460KB

Download
memory/2736-68-0x00000000020B0000-0x0000000002123000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads