modiloader | d3954aa089e2f6208ee2cf610d9639ef1fb918b9b01ff866e8a9a8ca3a95c6c9

General

Target

e728db244cee6dc853fea92eff438faa_JaffaCakes118.exe
Size

53KB
MD5

e728db244cee6dc853fea92eff438faa
SHA1

77f46692e6b16e6530dc7d49963ddf72bb7fdfc6
SHA256

d3954aa089e2f6208ee2cf610d9639ef1fb918b9b01ff866e8a9a8ca3a95c6c9
SHA512

180027b0a6cf1acf887bf97f7f6ce33f7d5e597c7019ff6661c073ad2d4a32a2667bf732fd931e26feb35542217d7905cc875746eee8394ecc1937af67c52cc6
SSDEEP

1536:MRgtnqqUfLqqqqqDTSqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqg:/vSmI0x/tP0EEferY

Score

10^/10

modiloader discovery persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/1252-29-0x0000000000400000-0x0000000000413000-memory.dmp	modiloader_stage2
behavioral2/memory/1252-28-0x0000000000400000-0x0000000000413000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	e728db244cee6dc853fea92eff438faa_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	msnmsgre48.exe

Executes dropped EXE 3 IoCs

pid	Process
1004	msnmsgre48.exe
1252	AppLaunch.exe
3556	Project.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1252-23-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/1252-27-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/1252-29-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/1252-28-0x0000000000400000-0x0000000000413000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msnmsgre = "\"C:\\ProgramData\\msnmsgre48.exe\""	Project.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1004 set thread context of 1252	1004	msnmsgre48.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e728db244cee6dc853fea92eff438faa_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msnmsgre48.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Project.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
596	cmd.exe
924	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
924	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1004	msnmsgre48.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3208	e728db244cee6dc853fea92eff438faa_JaffaCakes118.exe
Token: SeDebugPrivilege	1004	msnmsgre48.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 1004	3208	e728db244cee6dc853fea92eff438faa_JaffaCakes118.exe	82
PID 3208 wrote to memory of 1004	3208	e728db244cee6dc853fea92eff438faa_JaffaCakes118.exe	82
PID 3208 wrote to memory of 1004	3208	e728db244cee6dc853fea92eff438faa_JaffaCakes118.exe	82
PID 3208 wrote to memory of 596	3208	e728db244cee6dc853fea92eff438faa_JaffaCakes118.exe	83
PID 3208 wrote to memory of 596	3208	e728db244cee6dc853fea92eff438faa_JaffaCakes118.exe	83
PID 3208 wrote to memory of 596	3208	e728db244cee6dc853fea92eff438faa_JaffaCakes118.exe	83
PID 596 wrote to memory of 924	596	cmd.exe	85
PID 596 wrote to memory of 924	596	cmd.exe	85
PID 596 wrote to memory of 924	596	cmd.exe	85
PID 1004 wrote to memory of 1252	1004	msnmsgre48.exe	86
PID 1004 wrote to memory of 1252	1004	msnmsgre48.exe	86
PID 1004 wrote to memory of 1252	1004	msnmsgre48.exe	86
PID 1004 wrote to memory of 1252	1004	msnmsgre48.exe	86
PID 1004 wrote to memory of 1252	1004	msnmsgre48.exe	86
PID 1004 wrote to memory of 1252	1004	msnmsgre48.exe	86
PID 1004 wrote to memory of 1252	1004	msnmsgre48.exe	86
PID 1004 wrote to memory of 1252	1004	msnmsgre48.exe	86
PID 1004 wrote to memory of 3556	1004	msnmsgre48.exe	91
PID 1004 wrote to memory of 3556	1004	msnmsgre48.exe	91
PID 1004 wrote to memory of 3556	1004	msnmsgre48.exe	91

C:\Users\Admin\AppData\Local\Temp\e728db244cee6dc853fea92eff438faa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e728db244cee6dc853fea92eff438faa_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3208
- C:\ProgramData\msnmsgre48.exe
  "C:\ProgramData\msnmsgre48.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Users\Admin\AppData\Local\Temp\AppLaunch\AppLaunch.exe
    C:\Users\Admin\AppData\Local\Temp\\AppLaunch\AppLaunch.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\Project.exe
    "C:\Users\Admin\AppData\Local\Temp\Project.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /k ping 0 & del "C:\Users\Admin\AppData\Local\Temp\e728db244cee6dc853fea92eff438faa_JaffaCakes118.exe" & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:596
- - C:\Windows\SysWOW64\PING.EXE
    ping 0
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\msnmsgre48.exe

Filesize
53KB

MD5
e728db244cee6dc853fea92eff438faa

SHA1
77f46692e6b16e6530dc7d49963ddf72bb7fdfc6

SHA256
d3954aa089e2f6208ee2cf610d9639ef1fb918b9b01ff866e8a9a8ca3a95c6c9

SHA512
180027b0a6cf1acf887bf97f7f6ce33f7d5e597c7019ff6661c073ad2d4a32a2667bf732fd931e26feb35542217d7905cc875746eee8394ecc1937af67c52cc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\AppLaunch\AppLaunch.exe

Filesize
78KB

MD5
2b9482eb5d3af71029277e18f6c656c0

SHA1
d594dc39c6e5f8fbd145d8970e096dc1d9b4a7f1

SHA256
1be7a63415f03400065f2beb2ca991c8b0b914bd41310cf9dd93c5e1fc0ed072

SHA512
46abaf2e57e498dd60352f76b484825eff7ebdd89cf512ba046d229d5d24a34e5f67c48a1d59551e0b49603a1ffee2ffbc124eef0042ddf3fe7fae423b4af0a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Project.exe

Filesize
5KB

MD5
fd722bc246574f12bc298d7420dd27fe

SHA1
8f13477d04e74a0682755879c9670eb9390e187a

SHA256
97acc2bebfcbbec3b787d148c80701e674b1b6bf4c9e993b30e344e27692d341

SHA512
ae980ebfb02ff727236ee63a2cdfeeb0b33c1f59c142058edeb9030fb4f4f43f7f82cc965ebf77ee9ac71eb247dd24d9ff8ed02c37ae8792a70ad1a48c1bf41f

Download Submit
memory/1004-16-0x0000000074CA0000-0x0000000075251000-memory.dmp

Filesize
5.7MB

Download
memory/1004-41-0x0000000074CA0000-0x0000000075251000-memory.dmp

Filesize
5.7MB

Download
memory/1004-15-0x0000000074CA0000-0x0000000075251000-memory.dmp

Filesize
5.7MB

Download
memory/1004-18-0x0000000074CA0000-0x0000000075251000-memory.dmp

Filesize
5.7MB

Download
memory/1252-23-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1252-27-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1252-29-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1252-28-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3208-2-0x0000000074CA0000-0x0000000075251000-memory.dmp

Filesize
5.7MB

Download
memory/3208-0-0x0000000074CA2000-0x0000000074CA3000-memory.dmp

Filesize
4KB

Download
memory/3208-17-0x0000000074CA0000-0x0000000075251000-memory.dmp

Filesize
5.7MB

Download
memory/3208-1-0x0000000074CA0000-0x0000000075251000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads