modiloader | 7f4f1ac1695aafd0abc0d000f70ed1b75534d36f149115186abafa3ba059f20a

General

Target

d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe
Size

447KB
MD5

d6ede113188b8c9054d1174cfd2bd433
SHA1

b3409da93b849751ef1468df54bd5706879fb4be
SHA256

7f4f1ac1695aafd0abc0d000f70ed1b75534d36f149115186abafa3ba059f20a
SHA512

2f55aec1bbe93e2144819fc5da3b538f020c591772dd8f2322011f002010482d6c5c171e385b8ce34d9fa5f45666c0443aa3a1cedd73138c01e6b535bd6405a9
SSDEEP

12288:3s6Gedq//5Hd0a8uHVFIpqnUrEYxUt8MBGhMiIlBv:Ct//s1uHVqwnqEYxUt8ccjIlBv

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 7 IoCs

resource	yara_rule
behavioral1/memory/2128-5-0x0000000000400000-0x0000000000530200-memory.dmp	modiloader_stage2
behavioral1/memory/2088-15-0x0000000000400000-0x0000000000530200-memory.dmp	modiloader_stage2
behavioral1/memory/2088-19-0x0000000000400000-0x0000000000530200-memory.dmp	modiloader_stage2
behavioral1/memory/2128-26-0x0000000000400000-0x0000000000530200-memory.dmp	modiloader_stage2
behavioral1/memory/2128-35-0x0000000000400000-0x0000000000530200-memory.dmp	modiloader_stage2
behavioral1/memory/2088-37-0x0000000000400000-0x0000000000530200-memory.dmp	modiloader_stage2
behavioral1/memory/2088-38-0x0000000000400000-0x0000000000530200-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
3024	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2088	kaspersky.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2088 set thread context of 2568	2088	kaspersky.exe	31

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\_kaspersky.exe	kaspersky.exe
File opened for modification	C:\Program Files\_kaspersky.exe	kaspersky.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\kaspersky.exe	d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe
File opened for modification	C:\Windows\kaspersky.exe	d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe
File created	C:\Windows\SetupDel.bat	d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2936	2088	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kaspersky.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2088	2128	d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe	30
PID 2128 wrote to memory of 2088	2128	d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe	30
PID 2128 wrote to memory of 2088	2128	d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe	30
PID 2128 wrote to memory of 2088	2128	d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe	30
PID 2088 wrote to memory of 2568	2088	kaspersky.exe	31
PID 2088 wrote to memory of 2568	2088	kaspersky.exe	31
PID 2088 wrote to memory of 2568	2088	kaspersky.exe	31
PID 2088 wrote to memory of 2568	2088	kaspersky.exe	31
PID 2088 wrote to memory of 2568	2088	kaspersky.exe	31
PID 2088 wrote to memory of 2568	2088	kaspersky.exe	31
PID 2088 wrote to memory of 2936	2088	kaspersky.exe	32
PID 2088 wrote to memory of 2936	2088	kaspersky.exe	32
PID 2088 wrote to memory of 2936	2088	kaspersky.exe	32
PID 2088 wrote to memory of 2936	2088	kaspersky.exe	32
PID 2128 wrote to memory of 3024	2128	d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe	33
PID 2128 wrote to memory of 3024	2128	d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe	33
PID 2128 wrote to memory of 3024	2128	d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe	33
PID 2128 wrote to memory of 3024	2128	d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe	33
PID 2128 wrote to memory of 3024	2128	d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe	33
PID 2128 wrote to memory of 3024	2128	d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe	33
PID 2128 wrote to memory of 3024	2128	d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d6ede113188b8c9054d1174cfd2bd433_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\kaspersky.exe
  C:\Windows\kaspersky.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe"
    3⤵
    PID:2568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 280
    3⤵
    - Program crash
    PID:2936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\SetupDel.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SetupDel.bat

Filesize
212B

MD5
29fa96c47b626e0e9e7db5422b87cb49

SHA1
601f302f183afcb29ac25801b4a21db8aab2e35e

SHA256
1088fa281076330c73be3065d0cede69dfef0a87c12961539f95cedac3bca3ec

SHA512
0cd09a9e52b30c94a9e5c420a3b7ba9b5f347d16b48d7bfad7382f5e808fe5fcc1b7ed2ab9dae0acf3336415cad93889cd6700308fd541c9b0ebe075bf526b42

Download Submit
C:\Windows\kaspersky.exe

Filesize
447KB

MD5
d6ede113188b8c9054d1174cfd2bd433

SHA1
b3409da93b849751ef1468df54bd5706879fb4be

SHA256
7f4f1ac1695aafd0abc0d000f70ed1b75534d36f149115186abafa3ba059f20a

SHA512
2f55aec1bbe93e2144819fc5da3b538f020c591772dd8f2322011f002010482d6c5c171e385b8ce34d9fa5f45666c0443aa3a1cedd73138c01e6b535bd6405a9

Download Submit
memory/2088-19-0x0000000000400000-0x0000000000530200-memory.dmp

Filesize
1.2MB

Download
memory/2088-38-0x0000000000400000-0x0000000000530200-memory.dmp

Filesize
1.2MB

Download
memory/2088-37-0x0000000000400000-0x0000000000530200-memory.dmp

Filesize
1.2MB

Download
memory/2088-13-0x0000000000400000-0x0000000000530200-memory.dmp

Filesize
1.2MB

Download
memory/2088-15-0x0000000000400000-0x0000000000530200-memory.dmp

Filesize
1.2MB

Download
memory/2128-12-0x0000000003070000-0x00000000031A1000-memory.dmp

Filesize
1.2MB

Download
memory/2128-0-0x0000000000400000-0x0000000000530200-memory.dmp

Filesize
1.2MB

Download
memory/2128-14-0x0000000003070000-0x00000000031A1000-memory.dmp

Filesize
1.2MB

Download
memory/2128-26-0x0000000000400000-0x0000000000530200-memory.dmp

Filesize
1.2MB

Download
memory/2128-27-0x00000000004C0000-0x000000000052F000-memory.dmp

Filesize
444KB

Download
memory/2128-5-0x0000000000400000-0x0000000000530200-memory.dmp

Filesize
1.2MB

Download
memory/2128-35-0x0000000000400000-0x0000000000530200-memory.dmp

Filesize
1.2MB

Download
memory/2128-1-0x0000000000400000-0x0000000000530200-memory.dmp

Filesize
1.2MB

Download
memory/2128-2-0x00000000004C0000-0x000000000052F000-memory.dmp

Filesize
444KB

Download
memory/2568-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing