modiloader | 250654540ff155d7066781edca66fb7d90f11a7d02c69975a7f173a8c0838db4

General

Target

b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe
Size

282KB
MD5

b0858ab5b5423ca966a2eb4d09fca55b
SHA1

467733dd116fb33777b82ef98cc94aa42ebd43a7
SHA256

250654540ff155d7066781edca66fb7d90f11a7d02c69975a7f173a8c0838db4
SHA512

e386f45265c5df9b2caa931b51c21e3ca2858d9f70d84fae8d5476338edda91a4214f1f4c529ea80b181587e8617dd63fc871d59ba6c2ff286282e7df87315ae
SSDEEP

6144:OWmbe7S1g3HT7L8vpzYcbEIsQzq/2N0S+a0L20QKcLqOr+D:OWZ7S1g/+zYAEUzq/2uSZ0y0QXBA

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral1/memory/304-17-0x0000000000400000-0x0000000000552000-memory.dmp	modiloader_stage2
behavioral1/memory/304-36-0x0000000000400000-0x0000000000552000-memory.dmp	modiloader_stage2
behavioral1/memory/1980-38-0x0000000000400000-0x0000000000552000-memory.dmp	modiloader_stage2
behavioral1/memory/1980-39-0x0000000000400000-0x0000000000552000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
1904	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1980	note.exe

Loads dropped DLL 5 IoCs

pid	Process
304	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe
304	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe
932	WerFault.exe
932	WerFault.exe
932	WerFault.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\_note.exe	note.exe
File created	C:\Windows\SysWOW64\_note.exe	note.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 2120	1980	note.exe	32

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\note.exe	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\note.exe	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
932	1980	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	note.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 304 wrote to memory of 1980	304	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe	31
PID 304 wrote to memory of 1980	304	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe	31
PID 304 wrote to memory of 1980	304	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe	31
PID 304 wrote to memory of 1980	304	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe	31
PID 1980 wrote to memory of 2120	1980	note.exe	32
PID 1980 wrote to memory of 2120	1980	note.exe	32
PID 1980 wrote to memory of 2120	1980	note.exe	32
PID 1980 wrote to memory of 2120	1980	note.exe	32
PID 1980 wrote to memory of 2120	1980	note.exe	32
PID 1980 wrote to memory of 2120	1980	note.exe	32
PID 1980 wrote to memory of 932	1980	note.exe	33
PID 1980 wrote to memory of 932	1980	note.exe	33
PID 1980 wrote to memory of 932	1980	note.exe	33
PID 1980 wrote to memory of 932	1980	note.exe	33
PID 304 wrote to memory of 1904	304	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe	34
PID 304 wrote to memory of 1904	304	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe	34
PID 304 wrote to memory of 1904	304	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe	34
PID 304 wrote to memory of 1904	304	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe	34

C:\Users\Admin\AppData\Local\Temp\b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:304
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\note.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\note.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:2120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 272
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:932
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat""
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSInfo\Delet.bat

Filesize
212B

MD5
030f45b549f1e48b58d70abbe21489cd

SHA1
ee6b3665463756e09fb179b3b8051aef99dab7ab

SHA256
086b406545226b423908a7e8507608e7d4decec1cc1af6468a6b38eeb80193ff

SHA512
43ad33c8948f712f1966ba75376661252ca0639646b84c57c45a64b7030ba9078618331a26fc331663fbd428a1d1863983f826ad852cb86844104913b5ddbad7

Download Submit
\Program Files\Common Files\Microsoft Shared\MSInfo\note.exe

Filesize
282KB

MD5
b0858ab5b5423ca966a2eb4d09fca55b

SHA1
467733dd116fb33777b82ef98cc94aa42ebd43a7

SHA256
250654540ff155d7066781edca66fb7d90f11a7d02c69975a7f173a8c0838db4

SHA512
e386f45265c5df9b2caa931b51c21e3ca2858d9f70d84fae8d5476338edda91a4214f1f4c529ea80b181587e8617dd63fc871d59ba6c2ff286282e7df87315ae

Download Submit
memory/304-11-0x00000000034A0000-0x00000000035F2000-memory.dmp

Filesize
1.3MB

Download
memory/304-2-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/304-0-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/304-36-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/304-1-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/304-28-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/304-17-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/1980-18-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1980-13-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/1980-38-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/1980-39-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/2120-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2120-21-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/2120-23-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing