modiloader | ea337d10dbd13bb6552d4922d24e9016c7cfafba02d435b9a7495cd6f6fc1f54

General

Target

ebb715f0a3763ff0e7f892d26d53af4f_JaffaCakes118.exe
Size

747KB
MD5

ebb715f0a3763ff0e7f892d26d53af4f
SHA1

69bcaa7714fb6817c8b090b19946783445dbfb99
SHA256

ea337d10dbd13bb6552d4922d24e9016c7cfafba02d435b9a7495cd6f6fc1f54
SHA512

7221e89902a8b5c4909ae3b06f142fb383ac0e73ad1128309af9600bb58e98fb70e968fcd0f8504c3eda854147926b01cade0945715522692bb9f6c3507f8c61
SSDEEP

12288:CjhzKpuBIHZk7IkivM4jRxvE5Euh5DqF3Z4mxxUDqVTVOCV:C1zGNFjE5EMWQmXDVTzV

Score

10^/10

modiloader discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/4832-16-0x0000000000400000-0x0000000000515000-memory.dmp	modiloader_stage2
behavioral2/memory/4832-18-0x0000000000400000-0x0000000000515000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
4832	2008_S~2.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ebb715f0a3763ff0e7f892d26d53af4f_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FieleWay.txt	2008_S~2.EXE

Program crash 1 IoCs

pid	pid_target	Process	procid_target
964	4832	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebb715f0a3763ff0e7f892d26d53af4f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2008_S~2.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 4832	3436	ebb715f0a3763ff0e7f892d26d53af4f_JaffaCakes118.exe	83
PID 3436 wrote to memory of 4832	3436	ebb715f0a3763ff0e7f892d26d53af4f_JaffaCakes118.exe	83
PID 3436 wrote to memory of 4832	3436	ebb715f0a3763ff0e7f892d26d53af4f_JaffaCakes118.exe	83
PID 4832 wrote to memory of 4552	4832	2008_S~2.EXE	84
PID 4832 wrote to memory of 4552	4832	2008_S~2.EXE	84

C:\Users\Admin\AppData\Local\Temp\ebb715f0a3763ff0e7f892d26d53af4f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ebb715f0a3763ff0e7f892d26d53af4f_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2008_S~2.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2008_S~2.EXE
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    PID:4552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 620
    3⤵
    - Program crash
    PID:964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4832 -ip 4832
1⤵
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2008_S~2.EXE

Filesize
372KB

MD5
39e6091e8fc118e54bd37172848c455f

SHA1
d1c8c0557cc840d3831d142d91309b2734e0dcd4

SHA256
70fcc6c9d26aacf1be3ed53d5560882412d94ef71b83fc784cedbf4678177f19

SHA512
46c285bcf7506237b23fb66d837b7402f619aaebc996c8068e02bdf3ce8b70ca6befaea7c69d3c3bee3988283d79d9ce68f5e05d5c2d5093dff7d8155f7e693f

Download Submit
memory/3436-3-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/3436-9-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/3436-0-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/3436-4-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/3436-5-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/3436-6-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/3436-10-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/3436-2-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/3436-1-0x0000000001072000-0x0000000001073000-memory.dmp

Filesize
4KB

Download
memory/3436-20-0x0000000001000000-0x00000000010CB000-memory.dmp

Filesize
812KB

Download
memory/3436-17-0x0000000001072000-0x0000000001073000-memory.dmp

Filesize
4KB

Download
memory/4832-16-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4832-18-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/4832-14-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads