modiloader | b07a874234004167500fdcb2943469dc53f98ccaabe3ee323ad18e331a99ea73

General

Target

d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe
Size

1.4MB
MD5

d7d8861d85d511805da394b0ab8a35b0
SHA1

fbb42a3f2f4132ec239f4bbadddc5f178ed24391
SHA256

b07a874234004167500fdcb2943469dc53f98ccaabe3ee323ad18e331a99ea73
SHA512

c05bb16f237a5255cebe40b2eb38633d8adf09e92d1f8aa7f55a9c9e30d550edb90cf925ce9224bb8bec79ed23ae8d1cb6199c0f52cf023d239497ef235c499e
SSDEEP

24576:JWjGw4fYEDmoDIYM4kTucANkhpr6wXUBUey8R8rJhVp82K+Wge9xCE+:JWjNOY94qUW9rJdWHge9U

Score

10^/10

modiloader discovery evasion themida trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral1/memory/1700-1-0x0000000000401000-0x0000000000409000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-3-0x0000000000400000-0x0000000000615000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-21-0x0000000000401000-0x0000000000409000-memory.dmp	modiloader_stage2
behavioral1/memory/1700-20-0x0000000000400000-0x0000000000615000-memory.dmp	modiloader_stage2

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

pid	Process
2124	mlek.exe
1844	Bifrost.exe
2748	mlek.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine	d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe

Loads dropped DLL 5 IoCs

pid	Process
1700	d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe
1700	d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe
1700	d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe
1700	d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe
2124	mlek.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1700-0-0x0000000000400000-0x0000000000615000-memory.dmp	themida
behavioral1/memory/1700-3-0x0000000000400000-0x0000000000615000-memory.dmp	themida
behavioral1/memory/1700-20-0x0000000000400000-0x0000000000615000-memory.dmp	themida

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1700	d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2124 set thread context of 2748	2124	mlek.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mlek.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bifrost.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1700	d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe
2748	mlek.exe
2748	mlek.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1844	Bifrost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1844	Bifrost.exe
1844	Bifrost.exe
1844	Bifrost.exe
1844	Bifrost.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1844	1700	d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe	30
PID 1700 wrote to memory of 1844	1700	d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe	30
PID 1700 wrote to memory of 1844	1700	d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe	30
PID 1700 wrote to memory of 1844	1700	d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe	30
PID 1700 wrote to memory of 2124	1700	d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe	31
PID 1700 wrote to memory of 2124	1700	d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe	31
PID 1700 wrote to memory of 2124	1700	d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe	31
PID 1700 wrote to memory of 2124	1700	d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe	31
PID 2124 wrote to memory of 2748	2124	mlek.exe	32
PID 2124 wrote to memory of 2748	2124	mlek.exe	32
PID 2124 wrote to memory of 2748	2124	mlek.exe	32
PID 2124 wrote to memory of 2748	2124	mlek.exe	32
PID 2124 wrote to memory of 2748	2124	mlek.exe	32
PID 2124 wrote to memory of 2748	2124	mlek.exe	32
PID 2748 wrote to memory of 1124	2748	mlek.exe	20
PID 2748 wrote to memory of 1124	2748	mlek.exe	20
PID 2748 wrote to memory of 1124	2748	mlek.exe	20
PID 2748 wrote to memory of 1124	2748	mlek.exe	20

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1124
- C:\Users\Admin\AppData\Local\Temp\d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d7d8861d85d511805da394b0ab8a35b0_JaffaCakes118.exe"
  2⤵
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Users\Admin\AppData\Local\Temp\Bifrost.exe
    "C:\Users\Admin\AppData\Local\Temp\Bifrost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\mlek.exe
    "C:\Users\Admin\AppData\Local\Temp\mlek.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\mlek.exe
      C:\Users\Admin\AppData\Local\Temp\mlek.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mlek.exe

Filesize
64KB

MD5
b91f459e16ebe71f0796867bcd815725

SHA1
d344e4a6bdd848d5c151bce682a0e79e223efddc

SHA256
f71ac7f55dcfb009f71cafc2e476c57ad9fc6ca40f1ef461b578bea5826ce2aa

SHA512
6eb17a7d2072a4eb7aa01ab590c06642ddfef261b3e688a759ffc6ce1dedf4f5718646e9b0fccc7201576ec02bd10d3c52415b2b8453780fc5e446308f96e860

Download Submit
\Users\Admin\AppData\Local\Temp\Bifrost.exe

Filesize
1.2MB

MD5
e97d5e060420acd5008b56d0c375fefe

SHA1
7e63947053e60bdb88cc883eef7b818d0d50a67e

SHA256
fa97790738772eec28f0e51446e26784c9776098549c6254f88c78b7ea13b45b

SHA512
14b49d110948722522d1ab858d7488e49d3744f8a4872f6892037091dc687366ee2668aa53fdcd52568296ef1236c7d4cae3f2a5d2002a9e0deca88152c05007

Download Submit
memory/1124-43-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/1124-40-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1700-22-0x0000000004BD0000-0x0000000004D0A000-memory.dmp

Filesize
1.2MB

Download
memory/1700-1-0x0000000000401000-0x0000000000409000-memory.dmp

Filesize
32KB

Download
memory/1700-3-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/1700-0-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/1700-20-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/1700-21-0x0000000000401000-0x0000000000409000-memory.dmp

Filesize
32KB

Download
memory/1844-54-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1844-56-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1844-67-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1844-31-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1844-66-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1844-65-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1844-60-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1844-59-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2748-32-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2748-37-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2748-52-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2748-36-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2748-34-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2748-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2748-29-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads