modiloader | 0631919250c0213e9c2d9b11d6c23f86984159c47c31625e183f43eea6b39f90

General

Target

867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
Size

754KB
MD5

867092596904a7a789080c05e327b1f5
SHA1

d9c92a5d40af0dce43ba3427060b448e7296f7d1
SHA256

0631919250c0213e9c2d9b11d6c23f86984159c47c31625e183f43eea6b39f90
SHA512

46a2c3f0d7e80069416a50c06b6749d89c3369d4085bcff6a9345b1f1c7bcbcd24c7aa933dcd82ad8cd5bfbee8e94e0265978b40f9f89f228c8e119ed583c6c7
SSDEEP

12288:iJ1fm4weQtqAyniHImjS0V8IynFKqLJ031bF3Z4mxxyTSb56YH8W:+tqkAyncImnKnF1V031bQmXZ16YH

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2412-18-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/2412-21-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/2412-41-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/2836-44-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/2412-64-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/2836-66-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral1/memory/2836-68-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
2692	cmd.exe

Executes dropped EXE 1 IoCs

Processes:

re101.exe

pid	Process
2836	re101.exe

Loads dropped DLL 5 IoCs

Processes:

867092596904a7a789080c05e327b1f5_JaffaCakes118.exeWerFault.exe

pid	Process
2412	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
2412	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
2144	WerFault.exe
2144	WerFault.exe
2144	WerFault.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

867092596904a7a789080c05e327b1f5_JaffaCakes118.exe

description	ioc	Process
File opened (read-only)	\??\T:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\W:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\X:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\A:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\B:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\O:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\R:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\M:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\N:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\U:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\G:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\H:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\K:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\L:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\Z:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\E:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\I:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\J:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\S:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\P:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\Q:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\V:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\Y:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

867092596904a7a789080c05e327b1f5_JaffaCakes118.exe

description	ioc	Process
File created	F:\AutoRun.inf	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened for modification	F:\AutoRun.inf	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File created	C:\AutoRun.inf	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened for modification	C:\AutoRun.inf	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

Processes:

re101.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\_re101.exe	re101.exe
File opened for modification	C:\Windows\SysWOW64\_re101.exe	re101.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

re101.exe

description	pid	Process	procid_target
PID 2836 set thread context of 2960	2836	re101.exe	30

Drops file in Program Files directory 3 IoCs

Processes:

867092596904a7a789080c05e327b1f5_JaffaCakes118.exe

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\re101.exe	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\re101.exe	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2144	2836	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

867092596904a7a789080c05e327b1f5_JaffaCakes118.exere101.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	re101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

867092596904a7a789080c05e327b1f5_JaffaCakes118.exere101.exe

description	pid	Process	procid_target
PID 2412 wrote to memory of 2836	2412	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe	29
PID 2412 wrote to memory of 2836	2412	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe	29
PID 2412 wrote to memory of 2836	2412	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe	29
PID 2412 wrote to memory of 2836	2412	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe	29
PID 2836 wrote to memory of 2960	2836	re101.exe	30
PID 2836 wrote to memory of 2960	2836	re101.exe	30
PID 2836 wrote to memory of 2960	2836	re101.exe	30
PID 2836 wrote to memory of 2960	2836	re101.exe	30
PID 2836 wrote to memory of 2960	2836	re101.exe	30
PID 2836 wrote to memory of 2960	2836	re101.exe	30
PID 2836 wrote to memory of 2144	2836	re101.exe	31
PID 2836 wrote to memory of 2144	2836	re101.exe	31
PID 2836 wrote to memory of 2144	2836	re101.exe	31
PID 2836 wrote to memory of 2144	2836	re101.exe	31
PID 2412 wrote to memory of 2692	2412	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe	32
PID 2412 wrote to memory of 2692	2412	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe	32
PID 2412 wrote to memory of 2692	2412	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe	32
PID 2412 wrote to memory of 2692	2412	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\867092596904a7a789080c05e327b1f5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\re101.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\re101.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 320
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2144
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat""
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSInfo\DelSvel.bat

Filesize
212B

MD5
cafccb5eec5213be999230109f3bf5be

SHA1
47fd206b5fdba9341b052bac3ea97278ddec443a

SHA256
7973e98b7a4fcc5fed8c7c6cc471695831b5d96c18faed26c116724e10656547

SHA512
e1ed8b1ed317fc989e63ac4eea79f9973c346c574edca060bfd2fd2c58c1172e1275801a013d0c505d88fc82f34650aebfba5762768031af66bc21e360ee3a3f

Download Submit
F:\re101.exe

Filesize
754KB

MD5
867092596904a7a789080c05e327b1f5

SHA1
d9c92a5d40af0dce43ba3427060b448e7296f7d1

SHA256
0631919250c0213e9c2d9b11d6c23f86984159c47c31625e183f43eea6b39f90

SHA512
46a2c3f0d7e80069416a50c06b6749d89c3369d4085bcff6a9345b1f1c7bcbcd24c7aa933dcd82ad8cd5bfbee8e94e0265978b40f9f89f228c8e119ed583c6c7

Download Submit
memory/2412-5-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/2412-12-0x0000000003270000-0x0000000003271000-memory.dmp

Filesize
4KB

Download
memory/2412-18-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/2412-3-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download
memory/2412-16-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/2412-15-0x00000000032F0000-0x00000000032F1000-memory.dmp

Filesize
4KB

Download
memory/2412-13-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/2412-2-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

Filesize
4KB

Download
memory/2412-11-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2412-10-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/2412-9-0x0000000002010000-0x0000000002011000-memory.dmp

Filesize
4KB

Download
memory/2412-8-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Filesize
4KB

Download
memory/2412-7-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/2412-20-0x00000000004CF000-0x00000000004D0000-memory.dmp

Filesize
4KB

Download
memory/2412-0-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/2412-4-0x0000000002000000-0x0000000002001000-memory.dmp

Filesize
4KB

Download
memory/2412-17-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/2412-19-0x0000000003300000-0x0000000003301000-memory.dmp

Filesize
4KB

Download
memory/2412-6-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2412-14-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/2412-21-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/2412-64-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/2412-41-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/2412-39-0x00000000040D0000-0x0000000004225000-memory.dmp

Filesize
1.3MB

Download
memory/2412-38-0x00000000040D0000-0x0000000004225000-memory.dmp

Filesize
1.3MB

Download
memory/2412-1-0x00000000005C0000-0x0000000000614000-memory.dmp

Filesize
336KB

Download
memory/2412-53-0x00000000005C0000-0x0000000000614000-memory.dmp

Filesize
336KB

Download
memory/2836-44-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/2836-43-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/2836-42-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/2836-66-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/2836-68-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/2960-48-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads