modiloader | 6758ac0db732e1998e30c8f9354d385afabc507cdc1e2bcb949883c0f74fbfe4

General

Target

fad3300900546a317dc230fb94e16071_JaffaCakes118.exe
Size

933KB
MD5

fad3300900546a317dc230fb94e16071
SHA1

d657d93e57fd2eb43bbd19a423bb43d1fef036bc
SHA256

6758ac0db732e1998e30c8f9354d385afabc507cdc1e2bcb949883c0f74fbfe4
SHA512

4f69c100d6b9ddd3ab99a8d99a255e9cf3d2eba68d49dd0e1baf33742bd5bf812e8d90be4a8c233c2fe619bcdba37f79f911da5dd509da4eb55c0c9219546e2b
SSDEEP

24576:4RmJkcoQricOIQxiZY1iazQGeDvrai76m:9JZoQrbTFZY1iaXsF2m

Score

10^/10

modiloader discovery persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 6 IoCs

resource	yara_rule
behavioral2/memory/4660-12-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/4660-11-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/4660-24-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/4120-40-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/4120-39-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2
behavioral2/memory/4120-41-0x0000000000400000-0x0000000000414000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	fad3300900546a317dc230fb94e16071_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
964	AdobeART.exe
4120	AdobeART.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeART = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeART.exe"	AdobeART.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x00090000000234b8-17.dat	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2600 set thread context of 4660	2600	fad3300900546a317dc230fb94e16071_JaffaCakes118.exe	82
PID 964 set thread context of 4120	964	AdobeART.exe	84

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4660-8-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/4660-10-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/4660-12-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/4660-11-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/4660-24-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/4120-40-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/4120-39-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/4120-41-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fad3300900546a317dc230fb94e16071_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fad3300900546a317dc230fb94e16071_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeART.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeART.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 4660	2600	fad3300900546a317dc230fb94e16071_JaffaCakes118.exe	82
PID 2600 wrote to memory of 4660	2600	fad3300900546a317dc230fb94e16071_JaffaCakes118.exe	82
PID 2600 wrote to memory of 4660	2600	fad3300900546a317dc230fb94e16071_JaffaCakes118.exe	82
PID 2600 wrote to memory of 4660	2600	fad3300900546a317dc230fb94e16071_JaffaCakes118.exe	82
PID 2600 wrote to memory of 4660	2600	fad3300900546a317dc230fb94e16071_JaffaCakes118.exe	82
PID 4660 wrote to memory of 964	4660	fad3300900546a317dc230fb94e16071_JaffaCakes118.exe	83
PID 4660 wrote to memory of 964	4660	fad3300900546a317dc230fb94e16071_JaffaCakes118.exe	83
PID 4660 wrote to memory of 964	4660	fad3300900546a317dc230fb94e16071_JaffaCakes118.exe	83
PID 964 wrote to memory of 4120	964	AdobeART.exe	84
PID 964 wrote to memory of 4120	964	AdobeART.exe	84
PID 964 wrote to memory of 4120	964	AdobeART.exe	84
PID 964 wrote to memory of 4120	964	AdobeART.exe	84
PID 964 wrote to memory of 4120	964	AdobeART.exe	84

C:\Users\Admin\AppData\Local\Temp\fad3300900546a317dc230fb94e16071_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fad3300900546a317dc230fb94e16071_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\fad3300900546a317dc230fb94e16071_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fad3300900546a317dc230fb94e16071_JaffaCakes118.exe
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Users\Admin\AppData\Roaming\AdobeART.exe
    "C:\Users\Admin\AppData\Roaming\AdobeART.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:964
  - - C:\Users\Admin\AppData\Roaming\AdobeART.exe
      C:\Users\Admin\AppData\Roaming\AdobeART.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut7000.tmp

Filesize
18KB

MD5
7129cc9d5e5abb0fb4614c85912709fb

SHA1
7b0e00ef1cfb17cdf1314d5a67fd3152a49b0a0f

SHA256
02779ff975dc077ea9a7f812e2530f9f1245a8d7b6600736dd0ce220cfcfc7e1

SHA512
e52f96129ef65c5846b59aeedaae6b83d5c91c526529887ae0f962cdd91f3f3595e3e0e9cccc7dbfe45170d019518afe563e3cb74b8d967a408ce5e9aa80f4d0

Download Submit
C:\Users\Admin\AppData\Roaming\AdobeART.exe

Filesize
933KB

MD5
fad3300900546a317dc230fb94e16071

SHA1
d657d93e57fd2eb43bbd19a423bb43d1fef036bc

SHA256
6758ac0db732e1998e30c8f9354d385afabc507cdc1e2bcb949883c0f74fbfe4

SHA512
4f69c100d6b9ddd3ab99a8d99a255e9cf3d2eba68d49dd0e1baf33742bd5bf812e8d90be4a8c233c2fe619bcdba37f79f911da5dd509da4eb55c0c9219546e2b

Download Submit
memory/4120-40-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4120-39-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4120-41-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4660-8-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4660-10-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4660-12-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4660-11-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4660-24-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads