modiloader | 1e7a548dcf53ec20366d199d7a1b8b3b8723e0fa797d994f1f3ff86add1ea8cf

General

Target

ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
Size

296KB
MD5

ef8021882f75940ff76968791d5bce75
SHA1

a8bd484c2c6e5098ba1a40006873d942989834d1
SHA256

1e7a548dcf53ec20366d199d7a1b8b3b8723e0fa797d994f1f3ff86add1ea8cf
SHA512

320140da82e26ba40465fa718a5591907b49cb64cc23775baf847d55d66b694b82d871715ad598edf8fd57b7522d26d851dc6107e4c5ce055c873a6273466b91
SSDEEP

6144:GsWXEYrnUGzb15WFLydUHHkbXxNa7yda55TgbHgisJ9PHiaI0:G17rnUabuLQUnaXna+da55Tgbux

Score

10^/10

modiloader discovery trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/4008-23-0x0000000000400000-0x00000000004C6000-memory.dmp	modiloader_stage2
behavioral2/memory/3516-25-0x0000000000400000-0x00000000004C6000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
4008	DNS.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3516-0-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/files/0x000100000000002b-10.dat	upx
behavioral2/memory/4008-15-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/2288-19-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/4008-23-0x0000000000400000-0x00000000004C6000-memory.dmp	upx
behavioral2/memory/3516-25-0x0000000000400000-0x00000000004C6000-memory.dmp	upx

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\V:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\W:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\A:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\G:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\H:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\Q:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\T:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\U:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\X:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\Z:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\E:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\I:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\M:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\P:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\R:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\S:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\Y:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\B:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\K:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\N:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\J:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened (read-only)	\??\O:	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	F:\AutoRun.inf	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened for modification	F:\AutoRun.inf	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File created	C:\AutoRun.inf	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened for modification	C:\AutoRun.inf	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_DNS.exe	DNS.exe
File opened for modification	C:\Windows\SysWOW64\_DNS.exe	DNS.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4008 set thread context of 2288	4008	DNS.exe	83

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\DNS.exe	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\DNS.exe	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2728	2288	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DNS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 4008	3516	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe	82
PID 3516 wrote to memory of 4008	3516	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe	82
PID 3516 wrote to memory of 4008	3516	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe	82
PID 4008 wrote to memory of 2288	4008	DNS.exe	83
PID 4008 wrote to memory of 2288	4008	DNS.exe	83
PID 4008 wrote to memory of 2288	4008	DNS.exe	83
PID 4008 wrote to memory of 2288	4008	DNS.exe	83
PID 4008 wrote to memory of 2288	4008	DNS.exe	83
PID 4008 wrote to memory of 1980	4008	DNS.exe	84
PID 4008 wrote to memory of 1980	4008	DNS.exe	84
PID 3516 wrote to memory of 3396	3516	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe	86
PID 3516 wrote to memory of 3396	3516	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe	86
PID 3516 wrote to memory of 3396	3516	ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ef8021882f75940ff76968791d5bce75_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\DNS.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\DNS.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:2288
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 12
      4⤵
      Program crash
      PID:2728
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    PID:1980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2288 -ip 2288
1⤵
PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSINFO\ReDelBat.bat

Filesize
212B

MD5
c8606c0be805485c96b3ed57a2219709

SHA1
3710a4507ccc4ee4cbaac8c3b67ec5d3ac71da5b

SHA256
aa1e84df5ffdb49c7139361f5e36200e577c032e052c1ec2f19e67b07f7d1f86

SHA512
98c02b4b1bd83475235bfd1ae1d6fb38b2910aad1134268f5119cd1a8c4523ca8d0be4e9fd7ba5668a62d2e4b71477256c9c019841faafdc1f0e20e672fa558a

Download Submit
F:\DNS.exe

Filesize
296KB

MD5
ef8021882f75940ff76968791d5bce75

SHA1
a8bd484c2c6e5098ba1a40006873d942989834d1

SHA256
1e7a548dcf53ec20366d199d7a1b8b3b8723e0fa797d994f1f3ff86add1ea8cf

SHA512
320140da82e26ba40465fa718a5591907b49cb64cc23775baf847d55d66b694b82d871715ad598edf8fd57b7522d26d851dc6107e4c5ce055c873a6273466b91

Download Submit
memory/2288-19-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/3516-0-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/3516-1-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/3516-25-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/4008-15-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/4008-23-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/4008-16-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads