modiloader | 36eadbf744dce8e262ee15292a0d1d588cd7fd8da7a7060e9a32d236e5586697

General

Target

f3be1ddce74a3901b6b53c1966920a11_JaffaCakes118.exe
Size

703KB
MD5

f3be1ddce74a3901b6b53c1966920a11
SHA1

51f0b4768ac36ce9b13673113115e3980f702ad3
SHA256

36eadbf744dce8e262ee15292a0d1d588cd7fd8da7a7060e9a32d236e5586697
SHA512

473d728e7210a3d71f296735fd88fa94f471201e16993f7ff2bc5bac6e6276a7b69426e67e1a57250e1bff9c57a4536f06df5217308a879e68e7897926005e90
SSDEEP

12288:TD6xl/sN2wyUP1cAU7oHBqWA9U1eKsQ7W5QBe1dM6i9VBX9wORpzGIPUAB:TMRWyUP1cAU7MNwUQhQ7W5QBeY64VBXj

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 14 IoCs

resource	yara_rule
behavioral1/memory/2884-2-0x0000000000400000-0x00000000004B7000-memory.dmp	modiloader_stage2
behavioral1/memory/2884-4-0x0000000000400000-0x00000000004B7000-memory.dmp	modiloader_stage2
behavioral1/memory/2884-6-0x0000000000400000-0x00000000004B7000-memory.dmp	modiloader_stage2
behavioral1/memory/2884-9-0x0000000000400000-0x00000000004B7000-memory.dmp	modiloader_stage2
behavioral1/memory/2884-12-0x0000000000400000-0x00000000004B7000-memory.dmp	modiloader_stage2
behavioral1/memory/2884-15-0x0000000000400000-0x00000000004B7000-memory.dmp	modiloader_stage2
behavioral1/memory/2884-18-0x0000000000400000-0x00000000004B7000-memory.dmp	modiloader_stage2
behavioral1/memory/2884-21-0x0000000000400000-0x00000000004B7000-memory.dmp	modiloader_stage2
behavioral1/memory/2884-24-0x0000000000400000-0x00000000004B7000-memory.dmp	modiloader_stage2
behavioral1/memory/2884-27-0x0000000000400000-0x00000000004B7000-memory.dmp	modiloader_stage2
behavioral1/memory/2884-30-0x0000000000400000-0x00000000004B7000-memory.dmp	modiloader_stage2
behavioral1/memory/2884-33-0x0000000000400000-0x00000000004B7000-memory.dmp	modiloader_stage2
behavioral1/memory/2884-36-0x0000000000400000-0x00000000004B7000-memory.dmp	modiloader_stage2
behavioral1/memory/2884-39-0x0000000000400000-0x00000000004B7000-memory.dmp	modiloader_stage2

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\run_error.log	f3be1ddce74a3901b6b53c1966920a11_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\run_error.log	f3be1ddce74a3901b6b53c1966920a11_JaffaCakes118.exe
File created	\??\c:\windows\ShootingStarts.EXE	f3be1ddce74a3901b6b53c1966920a11_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3be1ddce74a3901b6b53c1966920a11_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2884	f3be1ddce74a3901b6b53c1966920a11_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2884	f3be1ddce74a3901b6b53c1966920a11_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f3be1ddce74a3901b6b53c1966920a11_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3be1ddce74a3901b6b53c1966920a11_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\run_error.log

Filesize
12B

MD5
d9074f5716139796ec1a489700f865a0

SHA1
a283d7798390c16668e05a12aec35e29cf7e8f9f

SHA256
012f568377e78dac0d32cb941b53c0156a6837a275e2fa70ad0b573f0f53ebe2

SHA512
6fdae455e3ef8d550686e1952a0538e4abf031c2fb92281f55b7fe2bb689a9611d3888766f7155729fbecaf0af2e6f998b6db74cfd02e1d4609f8b86c32997c9

Download Submit
memory/2884-15-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2884-12-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2884-4-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2884-6-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2884-18-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2884-3-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2884-2-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2884-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2884-9-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2884-21-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2884-24-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2884-27-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2884-30-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2884-33-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2884-36-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2884-39-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download

Analysis

Sharing