modiloader | e676ac2792c569934db51f5d78d8abdfed2482af2685ec03247a96ffe29e7d53

General

Target

e0fb4b7b2c571360fccea0d2032f38f3_JaffaCakes118.exe
Size

450KB
MD5

e0fb4b7b2c571360fccea0d2032f38f3
SHA1

3f6c55bcbd3614d77b2d6278d91dfc6a2646d090
SHA256

e676ac2792c569934db51f5d78d8abdfed2482af2685ec03247a96ffe29e7d53
SHA512

6d52202a03676feff9c0270b3c226c4f50d923973691e95254f03436272780165a0528bbe010de14225acd8fbc4fe85c70b62926a9eb1affbc557a7439b45dd1
SSDEEP

6144:wcIwEvC7J8Cv+dA6v31O8lBukf6tf7k9RvtPQPdCqZXl0GCHfGKsnpPpeg5Nxxiz:wFmdKhfkmQkf6tf7klcCWwHu/Ag5w2O

Score

10^/10

modiloader discovery trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/4496-13-0x0000000000400000-0x0000000000477920-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	e0fb4b7b2c571360fccea0d2032f38f3_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2420	ãÑÇÌÚÉ ÊÇÑíÎ 3 ãÊæÓØ Ý 1.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c000000023b8c-4.dat	upx
behavioral2/memory/2420-9-0x0000000000400000-0x00000000006D7000-memory.dmp	upx
behavioral2/memory/2420-65-0x0000000000400000-0x00000000006D7000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e0fb4b7b2c571360fccea0d2032f38f3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ãÑÇÌÚÉ ÊÇÑíÎ 3 ãÊæÓØ Ý 1.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	e0fb4b7b2c571360fccea0d2032f38f3_JaffaCakes118.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
384	WINWORD.EXE
384	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3848	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3848	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
384	WINWORD.EXE
384	WINWORD.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
384	WINWORD.EXE
384	WINWORD.EXE
384	WINWORD.EXE
384	WINWORD.EXE
384	WINWORD.EXE
384	WINWORD.EXE
384	WINWORD.EXE
384	WINWORD.EXE
384	WINWORD.EXE
384	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 2420	4496	e0fb4b7b2c571360fccea0d2032f38f3_JaffaCakes118.exe	82
PID 4496 wrote to memory of 2420	4496	e0fb4b7b2c571360fccea0d2032f38f3_JaffaCakes118.exe	82
PID 4496 wrote to memory of 2420	4496	e0fb4b7b2c571360fccea0d2032f38f3_JaffaCakes118.exe	82
PID 4496 wrote to memory of 384	4496	e0fb4b7b2c571360fccea0d2032f38f3_JaffaCakes118.exe	83
PID 4496 wrote to memory of 384	4496	e0fb4b7b2c571360fccea0d2032f38f3_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\e0fb4b7b2c571360fccea0d2032f38f3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e0fb4b7b2c571360fccea0d2032f38f3_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Local\Temp\ãÑÇÌÚÉ ÊÇÑíÎ 3 ãÊæÓØ Ý 1.exe
  "C:\Users\Admin\AppData\Local\Temp\ãÑÇÌÚÉ ÊÇÑíÎ 3 ãÊæÓØ Ý 1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2420
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ãÑÇÌÚÉ ÊÇÑíÎ 3 ãÊæÓØ Ý 1.docx" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:384

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x4bc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TCDEBC4.tmp\sist02.xsl

Filesize
245KB

MD5
f883b260a8d67082ea895c14bf56dd56

SHA1
7954565c1f243d46ad3b1e2f1baf3281451fc14b

SHA256
ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

SHA512
d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ãÑÇÌÚÉ ÊÇÑíÎ 3 ãÊæÓØ Ý 1.docx

Filesize
35KB

MD5
405087a9fc996fdd5e0a233d4f5dd5f0

SHA1
6760a31c1f4377a3173b2237962a45e4331d7e90

SHA256
396082032fdf4670f08d50c9a162e75570e795f84b06ff7c2b82ec83bbf50481

SHA512
cb5f6e2a8b1542c16666e391aa285512827c6fe95a1331088a2728d822f0840fcc97a35fa983efd51538d6e2a5344b4552cf5856c1a0bb43a57e73a12fb1ee63

Download Submit
C:\Users\Admin\AppData\Local\Temp\ãÑÇÌÚÉ ÊÇÑíÎ 3 ãÊæÓØ Ý 1.exe

Filesize
404KB

MD5
7de5109d2dda77b835da451916de05b4

SHA1
8997fc9940e7dbee675ed2764b12d0ef41d0d168

SHA256
2302ba8bceee2eed2f7908074e13119e160c95940e2aa8d7d04be9c7fa5bc086

SHA512
93d381f1778d3f988ab206e56cd3413f57ac65e6284450f440a0dac7a97cea07cfc422ee00f65cb355fc689717bb0fc3e7a8ec1af21298030dbca8728597a319

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
1KB

MD5
2cb19272c121e8f60a66433f4a4d20f9

SHA1
2faef367715e80f265ca345735ab46f2a2e76bd9

SHA256
3f7e5781a2b32c74adfd13020c2a2854906280fabdf76d90961e29d91ca9b5f8

SHA512
a478cc7a288f0f3f0dbcbf6052af05540b92b695aea7798bcbc52f2025fd974a911ca8473e5ece593c1ef8efc95c0f5605120cfff14a1281141ca83cdf1a1256

Download Submit
memory/384-31-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/384-35-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/384-20-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/384-21-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/384-23-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/384-22-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/384-19-0x00007FFBDB2B0000-0x00007FFBDB2C0000-memory.dmp

Filesize
64KB

Download
memory/384-24-0x00007FFBD8F80000-0x00007FFBD8F90000-memory.dmp

Filesize
64KB

Download
memory/384-25-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/384-26-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/384-29-0x00007FFBD8F80000-0x00007FFBD8F90000-memory.dmp

Filesize
64KB

Download
memory/384-14-0x00007FFBDB2B0000-0x00007FFBDB2C0000-memory.dmp

Filesize
64KB

Download
memory/384-34-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/384-33-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/384-32-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/384-17-0x00007FFBDB2B0000-0x00007FFBDB2C0000-memory.dmp

Filesize
64KB

Download
memory/384-30-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/384-28-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/384-27-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/384-18-0x00007FFBDB2B0000-0x00007FFBDB2C0000-memory.dmp

Filesize
64KB

Download
memory/384-16-0x00007FFBDB2B0000-0x00007FFBDB2C0000-memory.dmp

Filesize
64KB

Download
memory/384-15-0x00007FFC1B2CD000-0x00007FFC1B2CE000-memory.dmp

Filesize
4KB

Download
memory/384-74-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/384-66-0x00007FFC1B2CD000-0x00007FFC1B2CE000-memory.dmp

Filesize
4KB

Download
memory/384-67-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/384-68-0x00007FFC1B230000-0x00007FFC1B425000-memory.dmp

Filesize
2.0MB

Download
memory/2420-65-0x0000000000400000-0x00000000006D7000-memory.dmp

Filesize
2.8MB

Download
memory/2420-9-0x0000000000400000-0x00000000006D7000-memory.dmp

Filesize
2.8MB

Download
memory/4496-13-0x0000000000400000-0x0000000000477920-memory.dmp

Filesize
478KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads