modiloader | 15ec190cd1510696b56bc112c84902c862f052d35d5eff70c9c6dec9ce99816e

General

Target

e58e2d2d2fab88e1b2f8c88aca3118b9_JaffaCakes118.exe
Size

1.0MB
MD5

e58e2d2d2fab88e1b2f8c88aca3118b9
SHA1

ae561eff64f535794c266a70c8506bb10d430bbd
SHA256

15ec190cd1510696b56bc112c84902c862f052d35d5eff70c9c6dec9ce99816e
SHA512

c072a53c3946af6a126c87c907f790e6721617cd2830d55b77efbe944b10c3e3545c523d0bfaa8981a65058cf9272160a7920c587c3d3b987bd597f3cb9382aa
SSDEEP

24576:Y3V7WvUvQp3+cNa+UyVD/YuB3l9+Du3FtAdhNDQjTj/:27DvQpNaHDu/Wu1tAdhNDQjTT

Score

10^/10

modiloader discovery evasion persistence themida trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msnmsgrs.exe

ModiLoader Second Stage 17 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012277-8.dat	modiloader_stage2
behavioral1/memory/2528-22-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral1/memory/2528-34-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral1/memory/1844-40-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral1/memory/1844-43-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral1/memory/1844-46-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral1/memory/1844-49-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral1/memory/1844-52-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral1/memory/1844-56-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral1/memory/1844-59-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral1/memory/1844-62-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral1/memory/1844-65-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral1/memory/1844-68-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral1/memory/1844-71-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral1/memory/1844-74-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral1/memory/1844-77-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral1/memory/1844-80-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

pid	Process
2528	12.exe
1844	msnmsgrs.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	e58e2d2d2fab88e1b2f8c88aca3118b9_JaffaCakes118.exe

Loads dropped DLL 3 IoCs

pid	Process
1724	e58e2d2d2fab88e1b2f8c88aca3118b9_JaffaCakes118.exe
1724	e58e2d2d2fab88e1b2f8c88aca3118b9_JaffaCakes118.exe
2528	12.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1724-0-0x0000000000400000-0x000000000057D000-memory.dmp	themida
behavioral1/memory/1724-4-0x0000000000400000-0x000000000057D000-memory.dmp	themida
behavioral1/memory/1724-6-0x0000000000400000-0x000000000057D000-memory.dmp	themida
behavioral1/memory/1724-20-0x0000000000400000-0x000000000057D000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\msnmsgr = "C:\\Windows\\msnmsgrs.exe"	msnmsgrs.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	12.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msnmsgrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msnmsgrs.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1724	e58e2d2d2fab88e1b2f8c88aca3118b9_JaffaCakes118.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\ntdtcstp.dll	msnmsgrs.exe
File created	C:\Windows\cmsetac.dll	msnmsgrs.exe
File created	C:\Windows\msnmsgrs.exe	12.exe
File opened for modification	C:\Windows\msnmsgrs.exe	12.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msnmsgrs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e58e2d2d2fab88e1b2f8c88aca3118b9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1724	e58e2d2d2fab88e1b2f8c88aca3118b9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2528	12.exe
Token: SeBackupPrivilege	2624	vssvc.exe
Token: SeRestorePrivilege	2624	vssvc.exe
Token: SeAuditPrivilege	2624	vssvc.exe
Token: SeDebugPrivilege	1844	msnmsgrs.exe
Token: SeDebugPrivilege	1844	msnmsgrs.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2880	DllHost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1724	e58e2d2d2fab88e1b2f8c88aca3118b9_JaffaCakes118.exe
1844	msnmsgrs.exe
1844	msnmsgrs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2528	1724	e58e2d2d2fab88e1b2f8c88aca3118b9_JaffaCakes118.exe	30
PID 1724 wrote to memory of 2528	1724	e58e2d2d2fab88e1b2f8c88aca3118b9_JaffaCakes118.exe	30
PID 1724 wrote to memory of 2528	1724	e58e2d2d2fab88e1b2f8c88aca3118b9_JaffaCakes118.exe	30
PID 1724 wrote to memory of 2528	1724	e58e2d2d2fab88e1b2f8c88aca3118b9_JaffaCakes118.exe	30
PID 2528 wrote to memory of 1844	2528	12.exe	36
PID 2528 wrote to memory of 1844	2528	12.exe	36
PID 2528 wrote to memory of 1844	2528	12.exe	36
PID 2528 wrote to memory of 1844	2528	12.exe	36

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msnmsgrs.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\e58e2d2d2fab88e1b2f8c88aca3118b9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e58e2d2d2fab88e1b2f8c88aca3118b9_JaffaCakes118.exe"
1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\12.exe
  "C:\Users\Admin\AppData\Local\Temp\12.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\msnmsgrs.exe
    "C:\Windows\msnmsgrs.exe" \melt "C:\Users\Admin\AppData\Local\Temp\12.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:1844

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pegadinhadomalandrow.jpg

Filesize
114KB

MD5
119e5752e236a5e52c82b482918682db

SHA1
cd1e3bb34e5442d779966059f84c8f722a98ab68

SHA256
3034da60dda68bb8889a76fe82383862e6ad1a9800e5c04c31e89dab0ae6f630

SHA512
2029fe4d8a3bab9d376e97b08128dca683ba7b3ca8ccbdecf73d53c070479b4ae441a690011bf32cd891f3ba5cdc60c323a7ab3a54f4a149fe5dd6560941ee08

Download Submit
\Users\Admin\AppData\Local\Temp\12.exe

Filesize
273KB

MD5
ab03f7d12eb1c9ec8ecc1c4a50b0dcfc

SHA1
d5d5cde4ddb4892198ac2dae47d142313bf57aa4

SHA256
234a9c6dc4217c935692268a0d3b3c7f889d80463e53d9fed11965cf1f7f36f0

SHA512
8343608a58d12a56f9f767afbf6f69b23db6c831bc366075918d4004292cec6c030f5691bfa195aab5ba33e34fde5a158f5fe486f74d173bed569e053ffb1cb5

Download Submit
memory/1724-1-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/1724-4-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/1724-6-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/1724-16-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/1724-0-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/1724-17-0x0000000005760000-0x0000000005762000-memory.dmp

Filesize
8KB

Download
memory/1724-20-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/1844-41-0x00000000002C0000-0x00000000002C8000-memory.dmp

Filesize
32KB

Download
memory/1844-62-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1844-80-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1844-38-0x0000000001EF0000-0x0000000001EFE000-memory.dmp

Filesize
56KB

Download
memory/1844-40-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1844-77-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1844-42-0x0000000001EF0000-0x0000000001EFE000-memory.dmp

Filesize
56KB

Download
memory/1844-43-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1844-46-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1844-49-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1844-52-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1844-56-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1844-59-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1844-74-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1844-65-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1844-68-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1844-71-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2528-22-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2528-34-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2880-18-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads