modiloader | 755f844127faff618e3aa59c9f5ca5cdf69de6f8a1bd31143656aa378f0b17db

General

Target

b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe
Size

285KB
MD5

b0d2b0ce538409816e44e9bb905504c8
SHA1

532a7d66ea9689d6dd7990a5ce821bbcff169a3f
SHA256

755f844127faff618e3aa59c9f5ca5cdf69de6f8a1bd31143656aa378f0b17db
SHA512

8444b61d077da1040a2987b00187bdf02a7b241121ae73debb5828783e4fe7ef0f272705c5352363452669472f00424ecede16fc7ac131e02a3a6557c4e858de
SSDEEP

6144:oH0WTf6p+an7GikE8tCbaro13qNWwTEQSqpaJNFA5AaJqVxR:oUWTf6pFn7Gg8gbP9q4wTEQSQBo

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 5 IoCs

resource	yara_rule
behavioral1/memory/2368-3-0x0000000000400000-0x00000000005D6000-memory.dmp	modiloader_stage2
behavioral1/memory/2368-16-0x0000000000400000-0x00000000005D6000-memory.dmp	modiloader_stage2
behavioral1/memory/1544-18-0x0000000000400000-0x00000000005D6000-memory.dmp	modiloader_stage2
behavioral1/memory/2368-42-0x0000000000400000-0x00000000005D6000-memory.dmp	modiloader_stage2
behavioral1/memory/1544-41-0x0000000000400000-0x00000000005D6000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
2756	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1544	scvhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2368	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe
2368	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_scvhost.exe	scvhost.exe
File opened for modification	C:\Windows\SysWOW64\_scvhost.exe	scvhost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1544 set thread context of 2684	1544	scvhost.exe	31
PID 1544 set thread context of 2468	1544	scvhost.exe	32

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\scvhost.exe	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupDel.bat	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\scvhost.exe	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scvhost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2684	calc.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1544	2368	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe	30
PID 2368 wrote to memory of 1544	2368	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe	30
PID 2368 wrote to memory of 1544	2368	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe	30
PID 2368 wrote to memory of 1544	2368	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe	30
PID 1544 wrote to memory of 2684	1544	scvhost.exe	31
PID 1544 wrote to memory of 2684	1544	scvhost.exe	31
PID 1544 wrote to memory of 2684	1544	scvhost.exe	31
PID 1544 wrote to memory of 2684	1544	scvhost.exe	31
PID 1544 wrote to memory of 2684	1544	scvhost.exe	31
PID 1544 wrote to memory of 2684	1544	scvhost.exe	31
PID 1544 wrote to memory of 2468	1544	scvhost.exe	32
PID 1544 wrote to memory of 2468	1544	scvhost.exe	32
PID 1544 wrote to memory of 2468	1544	scvhost.exe	32
PID 1544 wrote to memory of 2468	1544	scvhost.exe	32
PID 1544 wrote to memory of 2468	1544	scvhost.exe	32
PID 1544 wrote to memory of 2468	1544	scvhost.exe	32
PID 2368 wrote to memory of 2756	2368	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe	33
PID 2368 wrote to memory of 2756	2368	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe	33
PID 2368 wrote to memory of 2756	2368	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe	33
PID 2368 wrote to memory of 2756	2368	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe	33
PID 2368 wrote to memory of 2756	2368	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe	33
PID 2368 wrote to memory of 2756	2368	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe	33
PID 2368 wrote to memory of 2756	2368	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\scvhost.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\scvhost.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    - Suspicious use of UnmapMainImage
    PID:2684
- - C:\Windows\SysWOW64\mstsc.exe
    "C:\Windows\system32\mstsc.exe"
    3⤵
    PID:2468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupDel.bat""
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSInfo\SetupDel.bat

Filesize
212B

MD5
6a7ba32223ec8d260a633e2d38ee2481

SHA1
a4759d4e769f169efb98d389ace50af5dbd549bd

SHA256
e4fdee9258a2af7522c28f5a0abc911cc2127c3ae10360645eaf482d8a8b3d02

SHA512
4fa5f74f5c4be8dbcc94ef4950b20ce06052c2f753ea3378cdc1ba4c72dfa7de8930834d41f8d513692ada7d4c4a076ed89eb25f3e3304050ea2755340dc7068

Download Submit
\Program Files\Common Files\Microsoft Shared\MSInfo\scvhost.exe

Filesize
285KB

MD5
b0d2b0ce538409816e44e9bb905504c8

SHA1
532a7d66ea9689d6dd7990a5ce821bbcff169a3f

SHA256
755f844127faff618e3aa59c9f5ca5cdf69de6f8a1bd31143656aa378f0b17db

SHA512
8444b61d077da1040a2987b00187bdf02a7b241121ae73debb5828783e4fe7ef0f272705c5352363452669472f00424ecede16fc7ac131e02a3a6557c4e858de

Download Submit
memory/1544-17-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/1544-41-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/1544-19-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/1544-18-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/1544-15-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/2368-16-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/2368-0-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/2368-14-0x00000000031C0000-0x0000000003396000-memory.dmp

Filesize
1.8MB

Download
memory/2368-4-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2368-1-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2368-2-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2368-42-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/2368-3-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/2468-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2684-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2684-27-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing