modiloader | 5d8d6fad5f36631d2607cdc622523b84b08de4cf4609724d7ae0e380a9118cf1

General

Target

ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
Size

732KB
MD5

ff538cc6046ad482c5c0000f595b47aa
SHA1

cb3a18662982aea123f6e69a30c617ebe0f91c11
SHA256

5d8d6fad5f36631d2607cdc622523b84b08de4cf4609724d7ae0e380a9118cf1
SHA512

591caf673126e0a7f3aa927f04fa865283cdeceb45ec821529148e88490bf12973f5e1e62daaf214ef7de6388ce983e1b3481d1b5251c2b723238976e4fbc348
SSDEEP

12288:5p3orwEBIjeDMBxrFlgv3gsgwuRF4crchjVlSVXeZXhWThK:5pY8YMBxrFlgvg2qT4p84RWTs

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral1/files/0x0001000000000027-9.dat	modiloader_stage2
behavioral1/memory/2908-36-0x0000000000400000-0x00000000004BD000-memory.dmp	modiloader_stage2
behavioral1/memory/2924-26-0x0000000000400000-0x00000000004BD000-memory.dmp	modiloader_stage2
behavioral1/memory/2616-29-0x0000000000400000-0x00000000004BD000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
2856	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2616	rejoice101.exe

Loads dropped DLL 2 IoCs

pid	Process
2908	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
2908	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\X:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\Y:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\Z:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\H:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\P:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\S:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\Q:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\R:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\U:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\A:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\E:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\G:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\N:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\W:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\I:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\K:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\M:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\O:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\T:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\B:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\J:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened (read-only)	\??\L:	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\AutoRun.inf	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File created	F:\AutoRun.inf	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened for modification	F:\AutoRun.inf	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File created	C:\AutoRun.inf	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_rejoice101.exe	rejoice101.exe
File opened for modification	C:\Windows\SysWOW64\_rejoice101.exe	rejoice101.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2616 set thread context of 2924	2616	rejoice101.exe	31

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelStr.bat	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rejoice101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2616	2908	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe	30
PID 2908 wrote to memory of 2616	2908	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe	30
PID 2908 wrote to memory of 2616	2908	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe	30
PID 2908 wrote to memory of 2616	2908	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe	30
PID 2616 wrote to memory of 2924	2616	rejoice101.exe	31
PID 2616 wrote to memory of 2924	2616	rejoice101.exe	31
PID 2616 wrote to memory of 2924	2616	rejoice101.exe	31
PID 2616 wrote to memory of 2924	2616	rejoice101.exe	31
PID 2616 wrote to memory of 2924	2616	rejoice101.exe	31
PID 2616 wrote to memory of 2924	2616	rejoice101.exe	31
PID 2616 wrote to memory of 1988	2616	rejoice101.exe	32
PID 2616 wrote to memory of 1988	2616	rejoice101.exe	32
PID 2616 wrote to memory of 1988	2616	rejoice101.exe	32
PID 2616 wrote to memory of 1988	2616	rejoice101.exe	32
PID 2908 wrote to memory of 2856	2908	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe	33
PID 2908 wrote to memory of 2856	2908	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe	33
PID 2908 wrote to memory of 2856	2908	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe	33
PID 2908 wrote to memory of 2856	2908	ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ff538cc6046ad482c5c0000f595b47aa_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice101.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:2924
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    PID:1988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelStr.bat""
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSInfo\DelStr.bat

Filesize
212B

MD5
08a9840386ac86ceef39f7e6ac4f18d8

SHA1
d398db5257e228eca6ed163f516bfb0aa54e7b74

SHA256
a782f3fe23959cf399f6214d75c6ebf087f973c4c56edee2d6cded5e72088052

SHA512
050ffefaf9f9d54a5a682729bb43e59b4f587a3643cce75200f889e164ca9800e55d8964d221153f8a7fc2c341a111fa8550485bb6d381263eff5cc5ddc5c40c

Download Submit
F:\rejoice101.exe

Filesize
732KB

MD5
ff538cc6046ad482c5c0000f595b47aa

SHA1
cb3a18662982aea123f6e69a30c617ebe0f91c11

SHA256
5d8d6fad5f36631d2607cdc622523b84b08de4cf4609724d7ae0e380a9118cf1

SHA512
591caf673126e0a7f3aa927f04fa865283cdeceb45ec821529148e88490bf12973f5e1e62daaf214ef7de6388ce983e1b3481d1b5251c2b723238976e4fbc348

Download Submit
memory/2616-18-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2616-29-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2908-8-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2908-36-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2924-26-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2924-24-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2924-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads