modiloader | 755f844127faff618e3aa59c9f5ca5cdf69de6f8a1bd31143656aa378f0b17db

General

Target

b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe
Size

285KB
MD5

b0d2b0ce538409816e44e9bb905504c8
SHA1

532a7d66ea9689d6dd7990a5ce821bbcff169a3f
SHA256

755f844127faff618e3aa59c9f5ca5cdf69de6f8a1bd31143656aa378f0b17db
SHA512

8444b61d077da1040a2987b00187bdf02a7b241121ae73debb5828783e4fe7ef0f272705c5352363452669472f00424ecede16fc7ac131e02a3a6557c4e858de
SSDEEP

6144:oH0WTf6p+an7GikE8tCbaro13qNWwTEQSqpaJNFA5AaJqVxR:oUWTf6pFn7Gg8gbP9q4wTEQSQBo

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 5 IoCs

resource	yara_rule
behavioral2/memory/540-4-0x0000000000400000-0x00000000005D6000-memory.dmp	modiloader_stage2
behavioral2/memory/540-11-0x0000000000400000-0x00000000005D6000-memory.dmp	modiloader_stage2
behavioral2/memory/3772-12-0x0000000000400000-0x00000000005D6000-memory.dmp	modiloader_stage2
behavioral2/memory/540-23-0x0000000000400000-0x00000000005D6000-memory.dmp	modiloader_stage2
behavioral2/memory/3772-22-0x0000000000400000-0x00000000005D6000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
3772	scvhost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\_scvhost.exe	scvhost.exe
File created	C:\Windows\SysWOW64\_scvhost.exe	scvhost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3772 set thread context of 3408	3772	scvhost.exe	85
PID 3772 set thread context of 3440	3772	scvhost.exe	86

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupDel.bat	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\scvhost.exe	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\scvhost.exe	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2008	3408	WerFault.exe	85
968	3440	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 3772	540	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe	84
PID 540 wrote to memory of 3772	540	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe	84
PID 540 wrote to memory of 3772	540	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe	84
PID 3772 wrote to memory of 3408	3772	scvhost.exe	85
PID 3772 wrote to memory of 3408	3772	scvhost.exe	85
PID 3772 wrote to memory of 3408	3772	scvhost.exe	85
PID 3772 wrote to memory of 3408	3772	scvhost.exe	85
PID 3772 wrote to memory of 3408	3772	scvhost.exe	85
PID 3772 wrote to memory of 3440	3772	scvhost.exe	86
PID 3772 wrote to memory of 3440	3772	scvhost.exe	86
PID 3772 wrote to memory of 3440	3772	scvhost.exe	86
PID 3772 wrote to memory of 3440	3772	scvhost.exe	86
PID 3772 wrote to memory of 3440	3772	scvhost.exe	86
PID 540 wrote to memory of 3048	540	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe	88
PID 540 wrote to memory of 3048	540	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe	88
PID 540 wrote to memory of 3048	540	b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b0d2b0ce538409816e44e9bb905504c8_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\scvhost.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\scvhost.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:3408
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 12
      4⤵
      Program crash
      PID:2008
- - C:\Windows\SysWOW64\mstsc.exe
    "C:\Windows\system32\mstsc.exe"
    3⤵
    PID:3440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 12
      4⤵
      Program crash
      PID:968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupDel.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3440 -ip 3440
1⤵
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3408 -ip 3408
1⤵
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupDel.bat

Filesize
212B

MD5
6a7ba32223ec8d260a633e2d38ee2481

SHA1
a4759d4e769f169efb98d389ace50af5dbd549bd

SHA256
e4fdee9258a2af7522c28f5a0abc911cc2127c3ae10360645eaf482d8a8b3d02

SHA512
4fa5f74f5c4be8dbcc94ef4950b20ce06052c2f753ea3378cdc1ba4c72dfa7de8930834d41f8d513692ada7d4c4a076ed89eb25f3e3304050ea2755340dc7068

Download Submit
C:\Program Files\Common Files\microsoft shared\MSInfo\scvhost.exe

Filesize
285KB

MD5
b0d2b0ce538409816e44e9bb905504c8

SHA1
532a7d66ea9689d6dd7990a5ce821bbcff169a3f

SHA256
755f844127faff618e3aa59c9f5ca5cdf69de6f8a1bd31143656aa378f0b17db

SHA512
8444b61d077da1040a2987b00187bdf02a7b241121ae73debb5828783e4fe7ef0f272705c5352363452669472f00424ecede16fc7ac131e02a3a6557c4e858de

Download Submit
memory/540-3-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/540-0-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/540-4-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/540-5-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/540-2-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/540-11-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/540-15-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/540-23-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/540-1-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/3408-17-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/3772-12-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/3772-16-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/3772-22-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing