modiloader | e5f96b91e4461e6c135b59975d96b0a049825440ba21408c94f89d88a0b7413f

General

Target

ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe
Size

398KB
MD5

ee92bfa71b3ff3c1fec7d8128de1a93d
SHA1

105e7f5a43a90cbb148fe72950fd717c478e13e8
SHA256

e5f96b91e4461e6c135b59975d96b0a049825440ba21408c94f89d88a0b7413f
SHA512

5a9e92eaba507d9aa02b911bb4fc57acf5012fb432330ef60d623e4c7e5f06b1c1cc8240dcb0722a0b2626d4452ba1011d3f007aff128fceaa46c3345d9f91b6
SSDEEP

12288:6pZ3P18DwSoHr9iBkD+s07qGLcvQU3XZlkVh:qVHrLD+D7/6rXjk

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral1/memory/2368-27-0x0000000000400000-0x00000000004D1A54-memory.dmp	modiloader_stage2
behavioral1/memory/2692-30-0x0000000000400000-0x00000000004D1A54-memory.dmp	modiloader_stage2
behavioral1/memory/2368-43-0x0000000000400000-0x00000000004D1A54-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
3040	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2692	MSInfo.exe

Loads dropped DLL 5 IoCs

pid	Process
2368	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe
2368	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe
2824	WerFault.exe
2824	WerFault.exe
2824	WerFault.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_MSInfo.exe	MSInfo.exe
File opened for modification	C:\Windows\SysWOW64\_MSInfo.exe	MSInfo.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2368	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe
2692	MSInfo.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2692 set thread context of 2180	2692	MSInfo.exe	30

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\MSInfo.exe	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\MSInfo.exe	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2824	2692	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSInfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2692	2368	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe	29
PID 2368 wrote to memory of 2692	2368	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe	29
PID 2368 wrote to memory of 2692	2368	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe	29
PID 2368 wrote to memory of 2692	2368	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe	29
PID 2692 wrote to memory of 2180	2692	MSInfo.exe	30
PID 2692 wrote to memory of 2180	2692	MSInfo.exe	30
PID 2692 wrote to memory of 2180	2692	MSInfo.exe	30
PID 2692 wrote to memory of 2180	2692	MSInfo.exe	30
PID 2692 wrote to memory of 2180	2692	MSInfo.exe	30
PID 2692 wrote to memory of 2180	2692	MSInfo.exe	30
PID 2692 wrote to memory of 2824	2692	MSInfo.exe	31
PID 2692 wrote to memory of 2824	2692	MSInfo.exe	31
PID 2692 wrote to memory of 2824	2692	MSInfo.exe	31
PID 2692 wrote to memory of 2824	2692	MSInfo.exe	31
PID 2368 wrote to memory of 3040	2368	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe	32
PID 2368 wrote to memory of 3040	2368	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe	32
PID 2368 wrote to memory of 3040	2368	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe	32
PID 2368 wrote to memory of 3040	2368	ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee92bfa71b3ff3c1fec7d8128de1a93d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\MSInfo.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\MSInfo.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\system32\mmc.exe"
    3⤵
    PID:2180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 284
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2824
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat""
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSInfo\DelSvel.bat

Filesize
212B

MD5
e47700e209fc0b607ec1707afab6de0d

SHA1
3501b49b2c7d347b1209b6c17946876c23f35c7c

SHA256
b736abcd03c660f8684f8e3a7b8f27be6cfc5f16a2a99e45e7d5b65d80af0d20

SHA512
656c8f7fad3479632a1d57538036779e5be16e2989b3fb36a99ce01c304952f79cf412b85e0ba57af2aa0a1ced7fcebb79ac8a2e241246c4da8c9d63bb8d65d7

Download Submit
\Program Files\Common Files\Microsoft Shared\MSInfo\MSInfo.exe

Filesize
398KB

MD5
ee92bfa71b3ff3c1fec7d8128de1a93d

SHA1
105e7f5a43a90cbb148fe72950fd717c478e13e8

SHA256
e5f96b91e4461e6c135b59975d96b0a049825440ba21408c94f89d88a0b7413f

SHA512
5a9e92eaba507d9aa02b911bb4fc57acf5012fb432330ef60d623e4c7e5f06b1c1cc8240dcb0722a0b2626d4452ba1011d3f007aff128fceaa46c3345d9f91b6

Download Submit
memory/2180-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2368-28-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2368-11-0x0000000003320000-0x00000000033F2000-memory.dmp

Filesize
840KB

Download
memory/2368-10-0x0000000003320000-0x00000000033F2000-memory.dmp

Filesize
840KB

Download
memory/2368-27-0x0000000000400000-0x00000000004D1A54-memory.dmp

Filesize
838KB

Download
memory/2368-0-0x0000000000400000-0x00000000004D1A54-memory.dmp

Filesize
838KB

Download
memory/2368-1-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2368-43-0x0000000000400000-0x00000000004D1A54-memory.dmp

Filesize
838KB

Download
memory/2692-13-0x0000000000400000-0x00000000004D1A54-memory.dmp

Filesize
838KB

Download
memory/2692-15-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2692-30-0x0000000000400000-0x00000000004D1A54-memory.dmp

Filesize
838KB

Download
memory/2692-32-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing