modiloader | 6f7e87de08d651dabc4b85a9ad2257e4e2b2d564bc61f74b3e65bb24b678145d

General

Target

868ecee5c3640e1af4a4522cceb4bbc0_JaffaCakes118.exe
Size

286KB
MD5

868ecee5c3640e1af4a4522cceb4bbc0
SHA1

4ae090e8036dc7ea46f0cfd7f3a7324181147748
SHA256

6f7e87de08d651dabc4b85a9ad2257e4e2b2d564bc61f74b3e65bb24b678145d
SHA512

f02c1b6b53f27229c131dd346bc9c357e42790c61804e705552dfcef8271ffa5b8c69fb29b6d3436ec04e66c1c0defe7561985055e15e704b2ca3e734499ec5c
SSDEEP

6144:vhCfU2BUGpN1yv5V+/JJNPnlJZe2jLrTVBSx:vhTuyv5VoRZfRB

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2688-22-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

video.exe

pid	Process
2800	video.exe

Loads dropped DLL 2 IoCs

Processes:

868ecee5c3640e1af4a4522cceb4bbc0_JaffaCakes118.exe

pid	Process
2688	868ecee5c3640e1af4a4522cceb4bbc0_JaffaCakes118.exe
2688	868ecee5c3640e1af4a4522cceb4bbc0_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

868ecee5c3640e1af4a4522cceb4bbc0_JaffaCakes118.exevideo.exeDllHost.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	868ecee5c3640e1af4a4522cceb4bbc0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	video.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid	Process
2584	DllHost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

DllHost.exe

pid	Process
2584	DllHost.exe
2584	DllHost.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

868ecee5c3640e1af4a4522cceb4bbc0_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2688 wrote to memory of 2800	2688	868ecee5c3640e1af4a4522cceb4bbc0_JaffaCakes118.exe	30
PID 2688 wrote to memory of 2800	2688	868ecee5c3640e1af4a4522cceb4bbc0_JaffaCakes118.exe	30
PID 2688 wrote to memory of 2800	2688	868ecee5c3640e1af4a4522cceb4bbc0_JaffaCakes118.exe	30
PID 2688 wrote to memory of 2800	2688	868ecee5c3640e1af4a4522cceb4bbc0_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\868ecee5c3640e1af4a4522cceb4bbc0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\868ecee5c3640e1af4a4522cceb4bbc0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Users\Admin\AppData\Local\Temp\video.exe
  "C:\Users\Admin\AppData\Local\Temp\video.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2800

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\25501_104609146241597_100000775371996_56119_7135554_n.jpg

Filesize
27KB

MD5
37377a08284c08e7144fcccf6c9e7019

SHA1
b5675fb365b733b2eb000fa55dabeb9112bc698c

SHA256
4738953a1b87537a6f54926077b06d31ccaea5bbe92c9912a1aec65b589ac0b8

SHA512
11298e3fe9848404e5e2d475da83c6cbfc8778490306ea05105431aefba49af289b3ccfee621ee6a2f736bb6ab409f32ba71af6f4fd2b153245ff2bba7949aae

Download Submit
\Users\Admin\AppData\Local\Temp\video.exe

Filesize
246KB

MD5
8188cbaa9a095340f938292a7be11580

SHA1
14f9d5cd7739bedc643d309921b043fe1f9cf857

SHA256
9eae2d27e697b9c61e51ee046083197950f1c9be6bc77f9461d9373b74217f4c

SHA512
70421066b72e688589cc69174c3acb98944928fc329338720d30055675cac638913777c2d9d1a727fbb40e594313519676a9319b9080be3b2add11f38838edea

Download Submit
memory/2584-21-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2688-22-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2688-20-0x00000000026C0000-0x00000000026C2000-memory.dmp

Filesize
8KB

Download
memory/2800-17-0x0000000077AE0000-0x0000000077AE1000-memory.dmp

Filesize
4KB

Download
memory/2800-12-0x00000000002E0000-0x000000000032C000-memory.dmp

Filesize
304KB

Download
memory/2800-14-0x0000000077AE0000-0x0000000077AE1000-memory.dmp

Filesize
4KB

Download
memory/2800-13-0x0000000001D80000-0x0000000001D90000-memory.dmp

Filesize
64KB

Download
memory/2800-19-0x00000000760C0000-0x00000000761D0000-memory.dmp

Filesize
1.1MB

Download
memory/2800-16-0x0000000077AE0000-0x0000000077AE1000-memory.dmp

Filesize
4KB

Download
memory/2800-18-0x00000000760D1000-0x00000000760D2000-memory.dmp

Filesize
4KB

Download
memory/2800-15-0x0000000077AE0000-0x0000000077AE1000-memory.dmp

Filesize
4KB

Download
memory/2800-11-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2800-24-0x00000000002E0000-0x000000000032C000-memory.dmp

Filesize
304KB

Download
memory/2800-25-0x0000000001D80000-0x0000000001D90000-memory.dmp

Filesize
64KB

Download
memory/2800-26-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2800-28-0x00000000760C0000-0x00000000761D0000-memory.dmp

Filesize
1.1MB

Download
memory/2800-29-0x00000000002E0000-0x000000000032C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads