modiloader | 0dceabef1683fdc8ac0a20f82627dc87f43c9fc234d01fff8008565d13b8ed75

General

Target

edbb96bace966f54ec89307a83536306_JaffaCakes118.exe
Size

640KB
MD5

edbb96bace966f54ec89307a83536306
SHA1

3a2ac68865f80037086d2673c20dcd245405800f
SHA256

0dceabef1683fdc8ac0a20f82627dc87f43c9fc234d01fff8008565d13b8ed75
SHA512

8d8a2c5ebd5080743b7401cb0132ef3a1ed82e77a4f4860cbb684292e42dbd2c9fc8d182c8b5db081262b9d766b2886619eda3024319d92391292697ea49a1ed
SSDEEP

12288:ys2rhPdsGc7MJ9iRuQGO9zUUHSPpvF3Z4mxx3sreSwH0dux9GwqEJ:ysWCxMJ09p9LHSPpvQmX3Me50dPe

Score

10^/10

modiloader discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/files/0x0009000000016115-5.dat	modiloader_stage2
behavioral1/memory/2556-23-0x0000000000400000-0x00000000004BC000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
2556	¸´¼þ20~1.EXE

Loads dropped DLL 7 IoCs

pid	Process
2508	edbb96bace966f54ec89307a83536306_JaffaCakes118.exe
2508	edbb96bace966f54ec89307a83536306_JaffaCakes118.exe
2556	¸´¼þ20~1.EXE
1728	WerFault.exe
1728	WerFault.exe
1728	WerFault.exe
1728	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	edbb96bace966f54ec89307a83536306_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FieleWay.txt	¸´¼þ20~1.EXE

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	2556	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edbb96bace966f54ec89307a83536306_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	¸´¼þ20~1.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2556	2508	edbb96bace966f54ec89307a83536306_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2556	2508	edbb96bace966f54ec89307a83536306_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2556	2508	edbb96bace966f54ec89307a83536306_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2556	2508	edbb96bace966f54ec89307a83536306_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2556	2508	edbb96bace966f54ec89307a83536306_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2556	2508	edbb96bace966f54ec89307a83536306_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2556	2508	edbb96bace966f54ec89307a83536306_JaffaCakes118.exe	30
PID 2556 wrote to memory of 1264	2556	¸´¼þ20~1.EXE	31
PID 2556 wrote to memory of 1264	2556	¸´¼þ20~1.EXE	31
PID 2556 wrote to memory of 1264	2556	¸´¼þ20~1.EXE	31
PID 2556 wrote to memory of 1264	2556	¸´¼þ20~1.EXE	31
PID 2556 wrote to memory of 1264	2556	¸´¼þ20~1.EXE	31
PID 2556 wrote to memory of 1264	2556	¸´¼þ20~1.EXE	31
PID 2556 wrote to memory of 1264	2556	¸´¼þ20~1.EXE	31
PID 2556 wrote to memory of 1728	2556	¸´¼þ20~1.EXE	32
PID 2556 wrote to memory of 1728	2556	¸´¼þ20~1.EXE	32
PID 2556 wrote to memory of 1728	2556	¸´¼þ20~1.EXE	32
PID 2556 wrote to memory of 1728	2556	¸´¼þ20~1.EXE	32
PID 2556 wrote to memory of 1728	2556	¸´¼þ20~1.EXE	32
PID 2556 wrote to memory of 1728	2556	¸´¼þ20~1.EXE	32
PID 2556 wrote to memory of 1728	2556	¸´¼þ20~1.EXE	32

C:\Users\Admin\AppData\Local\Temp\edbb96bace966f54ec89307a83536306_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\edbb96bace966f54ec89307a83536306_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ20~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ20~1.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    PID:1264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 308
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\IXP000.TMP\¸´¼þ20~1.EXE

Filesize
685KB

MD5
4a01cd22b45ec6618aa52625d84e5390

SHA1
2fb65f89d2292d1b0bbf37495bc972b3776a7894

SHA256
535a3774f4c17c730cb5c29e93ad0b279356e70d94fa015e2b70d28604a8affc

SHA512
1b2e995e2f1ee58662818694225375104633e91009a5931e030c1784592927c55402a2e9564e4c3c676d13ba80f97220ab9a6cc3152090b764589d7d47ee0f43

Download Submit
memory/2508-0-0x0000000001000000-0x00000000010FE000-memory.dmp

Filesize
1016KB

Download
memory/2508-1-0x00000000010AE000-0x00000000010AF000-memory.dmp

Filesize
4KB

Download
memory/2508-2-0x0000000001000000-0x00000000010FE000-memory.dmp

Filesize
1016KB

Download
memory/2508-19-0x0000000001000000-0x00000000010FE000-memory.dmp

Filesize
1016KB

Download
memory/2508-21-0x00000000010AE000-0x00000000010AF000-memory.dmp

Filesize
4KB

Download
memory/2508-20-0x00000000007D0000-0x00000000008CE000-memory.dmp

Filesize
1016KB

Download
memory/2556-23-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads