modiloader | 633a2ab5e59d3c12518098c6983d03b136af66d3c166ef996a379195904c7dfe

General

Target

f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
Size

274KB
MD5

f19e1926d98337f7e5080f51103f370a
SHA1

1b2fe0680f6cfc1f73d935130d982aab50a87c9f
SHA256

633a2ab5e59d3c12518098c6983d03b136af66d3c166ef996a379195904c7dfe
SHA512

2971d6b9e31843602cf59cda9f99a5cb6965b300d09bd14c31818d529a23565c587ba111c602d39547fd45da167d9170485253c0f0d5760fc91fdc245989ae06
SSDEEP

6144:E216IjDTPJY/+qGwV3Pa9V4MUCZ1PgRp+yLhoc+qtKRVqSlHxgX7nEf0h:Es/lYGqBV/i4MUmipVLh0DR4SlHah

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral2/memory/5040-3-0x0000000000400000-0x00000000004C5000-memory.dmp	modiloader_stage2
behavioral2/memory/5176-25-0x0000000000400000-0x00000000004C5000-memory.dmp	modiloader_stage2
behavioral2/memory/5040-26-0x0000000000400000-0x00000000004C5000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
5176	Bhsrv.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\O:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\P:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\Q:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\R:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\G:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\K:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\N:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\S:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\Y:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\A:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\H:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\I:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\M:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\T:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\Z:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\B:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\E:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\L:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\U:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\V:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\W:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened (read-only)	\??\X:	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\AutoRun.inf	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened for modification	C:\AutoRun.inf	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File created	F:\AutoRun.inf	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened for modification	F:\AutoRun.inf	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ReDelBat.bat	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Bhsrv.exe	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Bhsrv.exe	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Bhsrv.exe	Bhsrv.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhsrv.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 5176	5040	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe	84
PID 5040 wrote to memory of 5176	5040	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe	84
PID 5040 wrote to memory of 5176	5040	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe	84
PID 5040 wrote to memory of 5520	5040	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe	85
PID 5040 wrote to memory of 5520	5040	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe	85
PID 5040 wrote to memory of 5520	5040	f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f19e1926d98337f7e5080f51103f370a_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\Bhsrv.exe
  C:\Windows\system32\Bhsrv.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:5176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\ReDelBat.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ReDelBat.bat

Filesize
212B

MD5
b32e7483d83e1d8dbee909e1a71583cf

SHA1
aa900caf95ced55ff611ea52374d79df11e2904b

SHA256
d62ccdd5e8cebfcdb005ad4843ab5e6becb09469b9d0024fe3cd2a9b28786145

SHA512
066ac53cf6a6ff8e9c5a31a0ddd665ce5b665503d89d15006856cb0504d04af78636c67005069cc2b5b311c99f53bb11e7b2baa6fb8c5910ce2b71cd4ca08fb6

Download Submit
F:\Bhsrv.exe

Filesize
274KB

MD5
f19e1926d98337f7e5080f51103f370a

SHA1
1b2fe0680f6cfc1f73d935130d982aab50a87c9f

SHA256
633a2ab5e59d3c12518098c6983d03b136af66d3c166ef996a379195904c7dfe

SHA512
2971d6b9e31843602cf59cda9f99a5cb6965b300d09bd14c31818d529a23565c587ba111c602d39547fd45da167d9170485253c0f0d5760fc91fdc245989ae06

Download Submit
memory/5040-0-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/5040-1-0x00000000007A0000-0x00000000007A2000-memory.dmp

Filesize
8KB

Download
memory/5040-3-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/5040-4-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/5040-26-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/5176-18-0x0000000000590000-0x0000000000592000-memory.dmp

Filesize
8KB

Download
memory/5176-21-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/5176-25-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads