modiloader | fc9d18edc206492955cd79ce1a3e9db2d319dfade4429b0ed1c5947eac65d885

General

Target

aabb389281162ed1611def5e811edb7b_JaffaCakes118.exe
Size

298KB
MD5

aabb389281162ed1611def5e811edb7b
SHA1

82ce5b109256dd3f2a4a93a8809eee1d0e3f4b37
SHA256

fc9d18edc206492955cd79ce1a3e9db2d319dfade4429b0ed1c5947eac65d885
SHA512

e1ddb5654b0d816f04a9b37021a769fc7731844ca22f81e60c38b6db32e05d3f5c770f66f035d2d541b79ed9c5eed96a648e93d78f5380c60120185080ed4cb8
SSDEEP

6144:kK9qeqLca1QumBZJPie8KrBoBfZ9HAtgziC:kOqeqn1QxJEZFAtgzX

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/276-15-0x0000000000400000-0x0000000000452000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
2320	saleem.exe

Loads dropped DLL 2 IoCs

pid	Process
276	aabb389281162ed1611def5e811edb7b_JaffaCakes118.exe
276	aabb389281162ed1611def5e811edb7b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aabb389281162ed1611def5e811edb7b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	saleem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	saleem.exe
Token: 33	2320	saleem.exe
Token: SeIncBasePriorityPrivilege	2320	saleem.exe
Token: 33	2320	saleem.exe
Token: SeIncBasePriorityPrivilege	2320	saleem.exe
Token: 33	2320	saleem.exe
Token: SeIncBasePriorityPrivilege	2320	saleem.exe
Token: 33	2320	saleem.exe
Token: SeIncBasePriorityPrivilege	2320	saleem.exe
Token: 33	2320	saleem.exe
Token: SeIncBasePriorityPrivilege	2320	saleem.exe
Token: 33	2320	saleem.exe
Token: SeIncBasePriorityPrivilege	2320	saleem.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
972	DllHost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
972	DllHost.exe
972	DllHost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 276 wrote to memory of 2320	276	aabb389281162ed1611def5e811edb7b_JaffaCakes118.exe	31
PID 276 wrote to memory of 2320	276	aabb389281162ed1611def5e811edb7b_JaffaCakes118.exe	31
PID 276 wrote to memory of 2320	276	aabb389281162ed1611def5e811edb7b_JaffaCakes118.exe	31
PID 276 wrote to memory of 2320	276	aabb389281162ed1611def5e811edb7b_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\aabb389281162ed1611def5e811edb7b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aabb389281162ed1611def5e811edb7b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:276
- C:\Users\Admin\AppData\Local\Temp\saleem.exe
  "C:\Users\Admin\AppData\Local\Temp\saleem.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2320

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.JPG

Filesize
102KB

MD5
ac46ba9acb43f522745b8bb6a79d60e8

SHA1
817ec6b5c60eb256116a661148e6b712eea025fd

SHA256
77da8669e636165efd46995cfeac189eeb728000009277a65fb763b5c34fc5fc

SHA512
be232b82ae179a6662380dd13504b0b10a0391bad0303df0ceff4581e961738df332546e474764be703a536045592be8c8b362470c99d7fb0da344329390fbce

Download Submit
\Users\Admin\AppData\Local\Temp\saleem.exe

Filesize
183KB

MD5
909980b0106a24e77239aecf7e8f08d0

SHA1
4019e8413fc757814cfa31e2025ad5aff78df9dc

SHA256
48ca2a4472027cf707a4c54c500539f5ed905e6c8ca63b871a250f8a52f727df

SHA512
91e43fcd9364f5e3905d9243d93ba42f5db48379167105b275d0f3f17867ffc3b63355413e3444ec354f509c469de1c0d730c961c1537826220752d4fd1765fe

Download Submit
memory/276-12-0x0000000000890000-0x0000000000892000-memory.dmp

Filesize
8KB

Download
memory/276-15-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/972-14-0x0000000000320000-0x0000000000322000-memory.dmp

Filesize
8KB

Download
memory/2320-11-0x0000000074051000-0x0000000074052000-memory.dmp

Filesize
4KB

Download
memory/2320-13-0x0000000074050000-0x00000000745FB000-memory.dmp

Filesize
5.7MB

Download
memory/2320-16-0x0000000074050000-0x00000000745FB000-memory.dmp

Filesize
5.7MB

Download
memory/2320-18-0x0000000074050000-0x00000000745FB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing