modiloader | 6764596ec17f17b0430a00e254f33b339b131b9f1704ce5a375a2445833b6913

General

Target

eb1aaee9c3ecbaccfb0cad37fcddb869_JaffaCakes118.exe
Size

816KB
MD5

eb1aaee9c3ecbaccfb0cad37fcddb869
SHA1

d14028cb61e96a60310f0db918e77f99a1f57666
SHA256

6764596ec17f17b0430a00e254f33b339b131b9f1704ce5a375a2445833b6913
SHA512

ec6ec1d6eb577638873b587534b3d38a32c208147de37674b54b5d4a43d84fc5cf9c04caeebc6762a3f3dc11ea1aa1a210fe6f2ee39807e9dd020486804294e5
SSDEEP

24576:407ZzCibQVZsvAtXkgNmJ4bRCzSYcFPeh/8W:407ZGi8VkAKcm6ozw2

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/4372-21-0x0000000000400000-0x00000000004D3000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	eb1aaee9c3ecbaccfb0cad37fcddb869_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
4832	SpyNetSer.exe
60	DarknessFight ÇáÚÑÈí.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DarknessFight ÇáÚÑÈí.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb1aaee9c3ecbaccfb0cad37fcddb869_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4832	4372	eb1aaee9c3ecbaccfb0cad37fcddb869_JaffaCakes118.exe	83
PID 4372 wrote to memory of 4832	4372	eb1aaee9c3ecbaccfb0cad37fcddb869_JaffaCakes118.exe	83
PID 4372 wrote to memory of 60	4372	eb1aaee9c3ecbaccfb0cad37fcddb869_JaffaCakes118.exe	84
PID 4372 wrote to memory of 60	4372	eb1aaee9c3ecbaccfb0cad37fcddb869_JaffaCakes118.exe	84
PID 4372 wrote to memory of 60	4372	eb1aaee9c3ecbaccfb0cad37fcddb869_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\eb1aaee9c3ecbaccfb0cad37fcddb869_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb1aaee9c3ecbaccfb0cad37fcddb869_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Local\Temp\SpyNetSer.exe
  "C:\Users\Admin\AppData\Local\Temp\SpyNetSer.exe"
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Users\Admin\AppData\Local\Temp\DarknessFight ÇáÚÑÈí.exe
  "C:\Users\Admin\AppData\Local\Temp\DarknessFight ÇáÚÑÈí.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DarknessFight ÇáÚÑÈí.exe

Filesize
228KB

MD5
931950216fd671f8e6125527491b7cf9

SHA1
b79b3de6ed32ec8a136b038f69d0cbd1f28714a7

SHA256
c4bc9c5f5da3382241d560ca73fe6410a820cc98da630fefe5c2cfb6fca781fb

SHA512
2dc2b130ea7d53aa25c2f58400acf89b88de8fb4fe09cb3656ad8e728c9288be868207b99fa7c287c834ec425853f242236712698a92704c1680e7057367883e

Download Submit
C:\Users\Admin\AppData\Local\Temp\SpyNetSer.exe

Filesize
304KB

MD5
3d47f229266658c88cd348c9b9e48730

SHA1
9eac2ecc39cb6c7a42902078b09fb7afff5b677c

SHA256
a54034b73876dedaf489b08870c9c2aa950d3854e7a9886c218e2cf945917ae1

SHA512
aba967652b0c485131805bb84489e8252b0d3784c0ed0f670c7c61936816cdc3651a22bb47290258c6981d310f42fd816484eca5a81676ef87d0995327ca7528

Download Submit
memory/60-30-0x0000000005610000-0x0000000005BB4000-memory.dmp

Filesize
5.6MB

Download
memory/60-31-0x0000000005100000-0x0000000005192000-memory.dmp

Filesize
584KB

Download
memory/60-25-0x0000000004FC0000-0x000000000505C000-memory.dmp

Filesize
624KB

Download
memory/60-24-0x0000000000660000-0x00000000006A0000-memory.dmp

Filesize
256KB

Download
memory/60-38-0x0000000005250000-0x0000000005260000-memory.dmp

Filesize
64KB

Download
memory/60-27-0x00000000747FE000-0x00000000747FF000-memory.dmp

Filesize
4KB

Download
memory/60-37-0x00000000747FE000-0x00000000747FF000-memory.dmp

Filesize
4KB

Download
memory/60-35-0x0000000005260000-0x00000000052B6000-memory.dmp

Filesize
344KB

Download
memory/60-34-0x00000000050D0000-0x00000000050DA000-memory.dmp

Filesize
40KB

Download
memory/60-33-0x0000000005250000-0x0000000005260000-memory.dmp

Filesize
64KB

Download
memory/4372-21-0x0000000000400000-0x00000000004D3000-memory.dmp

Filesize
844KB

Download
memory/4832-32-0x000000001C3C0000-0x000000001C45C000-memory.dmp

Filesize
624KB

Download
memory/4832-23-0x00007FFCC7B05000-0x00007FFCC7B06000-memory.dmp

Filesize
4KB

Download
memory/4832-29-0x000000001BD10000-0x000000001C1DE000-memory.dmp

Filesize
4.8MB

Download
memory/4832-36-0x00007FFCC7850000-0x00007FFCC81F1000-memory.dmp

Filesize
9.6MB

Download
memory/4832-26-0x00007FFCC7850000-0x00007FFCC81F1000-memory.dmp

Filesize
9.6MB

Download
memory/4832-28-0x00007FFCC7B05000-0x00007FFCC7B06000-memory.dmp

Filesize
4KB

Download
memory/4832-40-0x00007FFCC7850000-0x00007FFCC81F1000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing