modiloader | 162996cb6f833e3828fdf94524afc33f0f6d9f32d3b163af389d958431be4391

General

Target

f5d2ac0b5b2a9fcd5e2dc1f27cde8dde_JaffaCakes118.exe
Size

431KB
MD5

f5d2ac0b5b2a9fcd5e2dc1f27cde8dde
SHA1

e61f908318c8e931dd7ae0711ed4464ede044094
SHA256

162996cb6f833e3828fdf94524afc33f0f6d9f32d3b163af389d958431be4391
SHA512

95c7bb3f0d891cd6d42ddf5d6473c46036ef68adae09ac82e3f9b05b968f610d168607e4af33b6fc24d7a4a3fc309073ef7cc890d9ee91923dd0996248c159d5
SSDEEP

12288:Vc//////8wTHpgtpdrQED77XFcYxU9rEhA7rPgCPi2UhmHg0R5:Vc//////hTH8aK/x4MCPiPAH55

Score

10^/10

modiloader discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/files/0x0009000000016ce7-24.dat	modiloader_stage2
behavioral1/memory/2496-33-0x0000000000400000-0x00000000004BBB68-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

pid	Process
2264	DATABASE1.exe
2496	DATABASE.exe

Loads dropped DLL 6 IoCs

pid	Process
2240	cmd.exe
2240	cmd.exe
2264	DATABASE1.exe
2264	DATABASE1.exe
2264	DATABASE1.exe
2496	DATABASE.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	DATABASE1.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DATABASE1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DATABASE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5d2ac0b5b2a9fcd5e2dc1f27cde8dde_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 2240	340	f5d2ac0b5b2a9fcd5e2dc1f27cde8dde_JaffaCakes118.exe	30
PID 340 wrote to memory of 2240	340	f5d2ac0b5b2a9fcd5e2dc1f27cde8dde_JaffaCakes118.exe	30
PID 340 wrote to memory of 2240	340	f5d2ac0b5b2a9fcd5e2dc1f27cde8dde_JaffaCakes118.exe	30
PID 340 wrote to memory of 2240	340	f5d2ac0b5b2a9fcd5e2dc1f27cde8dde_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2264	2240	cmd.exe	32
PID 2240 wrote to memory of 2264	2240	cmd.exe	32
PID 2240 wrote to memory of 2264	2240	cmd.exe	32
PID 2240 wrote to memory of 2264	2240	cmd.exe	32
PID 2240 wrote to memory of 2264	2240	cmd.exe	32
PID 2240 wrote to memory of 2264	2240	cmd.exe	32
PID 2240 wrote to memory of 2264	2240	cmd.exe	32
PID 2264 wrote to memory of 2496	2264	DATABASE1.exe	33
PID 2264 wrote to memory of 2496	2264	DATABASE1.exe	33
PID 2264 wrote to memory of 2496	2264	DATABASE1.exe	33
PID 2264 wrote to memory of 2496	2264	DATABASE1.exe	33
PID 2264 wrote to memory of 2496	2264	DATABASE1.exe	33
PID 2264 wrote to memory of 2496	2264	DATABASE1.exe	33
PID 2264 wrote to memory of 2496	2264	DATABASE1.exe	33

C:\Users\Admin\AppData\Local\Temp\f5d2ac0b5b2a9fcd5e2dc1f27cde8dde_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5d2ac0b5b2a9fcd5e2dc1f27cde8dde_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:340
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\DATABASE1.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Users\Admin\AppData\Local\Temp\DATABASE1.exe
    C:\Users\Admin\AppData\Local\Temp\DATABASE1.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DATABASE.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DATABASE.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\DATABASE1.exe

Filesize
343KB

MD5
e4f311caeed6252c1c76f76ab217cd46

SHA1
195483bbe6a491efad966f5bb0d1c5cc3d513878

SHA256
a71684494900c25215c6f9f086aba65b71ac4b7de36212f2de955bec8f3751db

SHA512
e630a4d7752d08059589a0ac2174d8f66dca63130d54941eb92b577002ebd6e4e98a3b3e8648a900e4908e3ff9ac88c80d5c52a7cb5d4f8bc14c20b3d6368ae5

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\DATABASE.exe

Filesize
676KB

MD5
04a3329a3eb9a780cbc03deb948a0e70

SHA1
1f70abad8bc72e93a7cc405cef876abd6fcf4723

SHA256
c3feb0a1055574437ad8724df3fb69a6b71ce3d8fe1d6dda84faa9855d887938

SHA512
81c0e4bb09bfd6dd5c0da6f4e30dfd87bc56071a284bb9a7de86011eab6149e37deb85d639648bedd889e7c80ff779f42ed4d780582eda51af7cc0b6fafce9d7

Download Submit
memory/340-16-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2496-33-0x0000000000400000-0x00000000004BBB68-memory.dmp

Filesize
750KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads