modiloader | 7e025d52f147e63cdcece9300dcdb4846b839ad9dcc87694528d17c99f630fd1

General

Target

ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
Size

587KB
MD5

ee9431d4218787c78857a097ef5e6822
SHA1

e6db13a74bf4c72b4e4bb7f1f924bae8f12abca9
SHA256

7e025d52f147e63cdcece9300dcdb4846b839ad9dcc87694528d17c99f630fd1
SHA512

b269567a3d491df3e53817c59760ca3fcdf6be2bc48de394be8afe5b67cb22392816f4949a8a9eb817a8b4c0bd6effb7f1a0fd60bd062637c4f4d9c366d87b23
SSDEEP

12288:2+C0h6jdxGd3lR43CLyas2jqeILUNpCF3Z4mxxKuxm1EZi9XxF9E2AGF:VTh0QlRUCLyafqINpCQmXRw1wi9D9E2b

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral1/memory/2104-46-0x0000000000400000-0x000000000055E000-memory.dmp	modiloader_stage2
behavioral1/memory/2788-52-0x0000000000400000-0x000000000055E000-memory.dmp	modiloader_stage2
behavioral1/memory/2104-63-0x0000000000400000-0x000000000055E000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
1372	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2788	Thvnder.exe

Loads dropped DLL 5 IoCs

pid	Process
2104	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
2104	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
2988	WerFault.exe
2988	WerFault.exe
2988	WerFault.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\Y:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\E:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\I:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\L:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\N:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\R:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\H:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\G:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\K:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\O:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\T:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\X:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\A:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\J:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\M:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\P:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\Q:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\S:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\U:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\W:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\B:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened (read-only)	\??\Z:	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	F:\AutoRun.inf	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened for modification	F:\AutoRun.inf	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File created	C:\AutoRun.inf	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened for modification	C:\AutoRun.inf	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_Thvnder.exe	Thvnder.exe
File opened for modification	C:\Windows\SysWOW64\_Thvnder.exe	Thvnder.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2788 set thread context of 2180	2788	Thvnder.exe	30

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Thvnder.exe	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File opened for modification	C:\Program Files\Thvnder.exe	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
File created	C:\Program Files\SxingDel.bat	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	2788	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Thvnder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2788	2104	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe	29
PID 2104 wrote to memory of 2788	2104	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe	29
PID 2104 wrote to memory of 2788	2104	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe	29
PID 2104 wrote to memory of 2788	2104	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe	29
PID 2788 wrote to memory of 2180	2788	Thvnder.exe	30
PID 2788 wrote to memory of 2180	2788	Thvnder.exe	30
PID 2788 wrote to memory of 2180	2788	Thvnder.exe	30
PID 2788 wrote to memory of 2180	2788	Thvnder.exe	30
PID 2788 wrote to memory of 2180	2788	Thvnder.exe	30
PID 2788 wrote to memory of 2180	2788	Thvnder.exe	30
PID 2788 wrote to memory of 2988	2788	Thvnder.exe	31
PID 2788 wrote to memory of 2988	2788	Thvnder.exe	31
PID 2788 wrote to memory of 2988	2788	Thvnder.exe	31
PID 2788 wrote to memory of 2988	2788	Thvnder.exe	31
PID 2104 wrote to memory of 1372	2104	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe	32
PID 2104 wrote to memory of 1372	2104	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe	32
PID 2104 wrote to memory of 1372	2104	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe	32
PID 2104 wrote to memory of 1372	2104	ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee9431d4218787c78857a097ef5e6822_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files\Thvnder.exe
  "C:\Program Files\Thvnder.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:2180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 320
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\SxingDel.bat""
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\SxingDel.bat

Filesize
212B

MD5
0484250a104dfd91e219ab29c3512ba8

SHA1
686694e4d33c0324caad7ec4f1e1f7c1cf98cf9c

SHA256
9a48ceca65920345c8bc582c3b83d9d9e4a4965c074a87d1374068cca750615a

SHA512
652c954114232cb33c038536ebc4a982d325d2ee066fb3a9b7e38156e3907becfe1d5db1d14c08b326f7d4bbbaa233f7302f13f44275c796c836e3136f964a73

Download Submit
F:\Thvnder.exe

Filesize
587KB

MD5
ee9431d4218787c78857a097ef5e6822

SHA1
e6db13a74bf4c72b4e4bb7f1f924bae8f12abca9

SHA256
7e025d52f147e63cdcece9300dcdb4846b839ad9dcc87694528d17c99f630fd1

SHA512
b269567a3d491df3e53817c59760ca3fcdf6be2bc48de394be8afe5b67cb22392816f4949a8a9eb817a8b4c0bd6effb7f1a0fd60bd062637c4f4d9c366d87b23

Download Submit
memory/2104-3-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/2104-63-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2104-0-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2104-12-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2104-11-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2104-10-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/2104-9-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/2104-8-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2104-7-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2104-6-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2104-5-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2104-4-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2104-13-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2104-15-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2104-48-0x0000000000350000-0x00000000003A4000-memory.dmp

Filesize
336KB

Download
memory/2104-2-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/2104-33-0x0000000003FC0000-0x000000000411E000-memory.dmp

Filesize
1.4MB

Download
memory/2104-32-0x0000000003FC0000-0x000000000411E000-memory.dmp

Filesize
1.4MB

Download
memory/2104-1-0x0000000000350000-0x00000000003A4000-memory.dmp

Filesize
336KB

Download
memory/2104-50-0x0000000003FC0000-0x000000000411E000-memory.dmp

Filesize
1.4MB

Download
memory/2104-46-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2104-14-0x0000000003270000-0x0000000003271000-memory.dmp

Filesize
4KB

Download
memory/2104-49-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2180-42-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2180-39-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2788-52-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2788-35-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads