modiloader | 250654540ff155d7066781edca66fb7d90f11a7d02c69975a7f173a8c0838db4

General

Target

b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe
Size

282KB
MD5

b0858ab5b5423ca966a2eb4d09fca55b
SHA1

467733dd116fb33777b82ef98cc94aa42ebd43a7
SHA256

250654540ff155d7066781edca66fb7d90f11a7d02c69975a7f173a8c0838db4
SHA512

e386f45265c5df9b2caa931b51c21e3ca2858d9f70d84fae8d5476338edda91a4214f1f4c529ea80b181587e8617dd63fc871d59ba6c2ff286282e7df87315ae
SSDEEP

6144:OWmbe7S1g3HT7L8vpzYcbEIsQzq/2N0S+a0L20QKcLqOr+D:OWZ7S1g/+zYAEUzq/2uSZ0y0QXBA

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/3664-16-0x0000000000400000-0x0000000000552000-memory.dmp	modiloader_stage2
behavioral2/memory/4440-17-0x0000000000400000-0x0000000000552000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
3664	note.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_note.exe	note.exe
File opened for modification	C:\Windows\SysWOW64\_note.exe	note.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3664 set thread context of 2388	3664	note.exe	83

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\note.exe	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\note.exe	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2628	2388	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	note.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 3664	4440	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe	82
PID 4440 wrote to memory of 3664	4440	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe	82
PID 4440 wrote to memory of 3664	4440	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe	82
PID 3664 wrote to memory of 2388	3664	note.exe	83
PID 3664 wrote to memory of 2388	3664	note.exe	83
PID 3664 wrote to memory of 2388	3664	note.exe	83
PID 3664 wrote to memory of 2388	3664	note.exe	83
PID 3664 wrote to memory of 2388	3664	note.exe	83
PID 3664 wrote to memory of 3852	3664	note.exe	84
PID 3664 wrote to memory of 3852	3664	note.exe	84
PID 4440 wrote to memory of 2952	4440	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe	86
PID 4440 wrote to memory of 2952	4440	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe	86
PID 4440 wrote to memory of 2952	4440	b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b0858ab5b5423ca966a2eb4d09fca55b_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\note.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\note.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:2388
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 12
      4⤵
      Program crash
      PID:2628
- - C:\program files\internet explorer\iexplore.exe
    "C:\program files\internet explorer\iexplore.exe"
    3⤵
    PID:3852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 2388 -ip 2388
1⤵
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat

Filesize
212B

MD5
030f45b549f1e48b58d70abbe21489cd

SHA1
ee6b3665463756e09fb179b3b8051aef99dab7ab

SHA256
086b406545226b423908a7e8507608e7d4decec1cc1af6468a6b38eeb80193ff

SHA512
43ad33c8948f712f1966ba75376661252ca0639646b84c57c45a64b7030ba9078618331a26fc331663fbd428a1d1863983f826ad852cb86844104913b5ddbad7

Download Submit
C:\Program Files\Common Files\microsoft shared\MSInfo\note.exe

Filesize
282KB

MD5
b0858ab5b5423ca966a2eb4d09fca55b

SHA1
467733dd116fb33777b82ef98cc94aa42ebd43a7

SHA256
250654540ff155d7066781edca66fb7d90f11a7d02c69975a7f173a8c0838db4

SHA512
e386f45265c5df9b2caa931b51c21e3ca2858d9f70d84fae8d5476338edda91a4214f1f4c529ea80b181587e8617dd63fc871d59ba6c2ff286282e7df87315ae

Download Submit
memory/2388-12-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/3664-8-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/3664-11-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/3664-16-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/4440-0-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/4440-1-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/4440-2-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/4440-17-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing