modiloader | 7547996619c7d12d820166710917a1504a5a58804329c0e197d44908f96e80d7

General

Target

f7161dd9296727f78545a800f5361e86_JaffaCakes118.exe
Size

644KB
MD5

f7161dd9296727f78545a800f5361e86
SHA1

2cbc29c892602dd79d7f94dfa0c2f170c580eb1d
SHA256

7547996619c7d12d820166710917a1504a5a58804329c0e197d44908f96e80d7
SHA512

8c8fe1f4a128ee0886bbbecf53a5a2ba0048e1785e14b02e0d4fa823b581be9303fb42cc83b38fb598887fcd831917e49a038e5b0d4b6cbf2a5a3071bb093610
SSDEEP

12288:vWz3v7jRA2mdU7npAyy8gGlo86lDpE1c2obY7wJ+zNGv63bg:ez/ZAMmyyOcpmoctJGv+0

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral1/memory/2336-40-0x0000000000400000-0x0000000000568000-memory.dmp	modiloader_stage2
behavioral1/memory/1780-44-0x0000000000400000-0x0000000000568000-memory.dmp	modiloader_stage2
behavioral1/memory/1780-55-0x0000000000400000-0x0000000000568000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
2996	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1780	QQ.exe

Loads dropped DLL 2 IoCs

pid	Process
2336	f7161dd9296727f78545a800f5361e86_JaffaCakes118.exe
2336	f7161dd9296727f78545a800f5361e86_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_QQ.exe	QQ.exe
File opened for modification	C:\Windows\SysWOW64\_QQ.exe	QQ.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\QQ.exe	f7161dd9296727f78545a800f5361e86_JaffaCakes118.exe
File opened for modification	C:\Program Files\QQ.exe	f7161dd9296727f78545a800f5361e86_JaffaCakes118.exe
File created	C:\Program Files\DelSvel.bat	f7161dd9296727f78545a800f5361e86_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f7161dd9296727f78545a800f5361e86_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QQ.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1780	2336	f7161dd9296727f78545a800f5361e86_JaffaCakes118.exe	30
PID 2336 wrote to memory of 1780	2336	f7161dd9296727f78545a800f5361e86_JaffaCakes118.exe	30
PID 2336 wrote to memory of 1780	2336	f7161dd9296727f78545a800f5361e86_JaffaCakes118.exe	30
PID 2336 wrote to memory of 1780	2336	f7161dd9296727f78545a800f5361e86_JaffaCakes118.exe	30
PID 2336 wrote to memory of 2996	2336	f7161dd9296727f78545a800f5361e86_JaffaCakes118.exe	31
PID 2336 wrote to memory of 2996	2336	f7161dd9296727f78545a800f5361e86_JaffaCakes118.exe	31
PID 2336 wrote to memory of 2996	2336	f7161dd9296727f78545a800f5361e86_JaffaCakes118.exe	31
PID 2336 wrote to memory of 2996	2336	f7161dd9296727f78545a800f5361e86_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\f7161dd9296727f78545a800f5361e86_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f7161dd9296727f78545a800f5361e86_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files\QQ.exe
  "C:\Program Files\QQ.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:1780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files\DelSvel.bat""
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\DelSvel.bat

Filesize
212B

MD5
6dad894105733f4aa579dc3cb65c0a89

SHA1
52abed96adf8329b213876aef1d3508faa6fc2f7

SHA256
b5207f0b2a36be15e8146c564c947d0c9adaa69be4742ae7f9fe8b79ffbe7fc9

SHA512
fe165f7ea5c773c4d2accfb43a4a84212206bb6f81455be82f6a3b41d3be1d6f398eb4f2efa72b1040d16c7d7a0ba9ac499f4b490db26a2cb9a8db3ee22687f4

Download Submit
\Program Files\QQ.exe

Filesize
644KB

MD5
f7161dd9296727f78545a800f5361e86

SHA1
2cbc29c892602dd79d7f94dfa0c2f170c580eb1d

SHA256
7547996619c7d12d820166710917a1504a5a58804329c0e197d44908f96e80d7

SHA512
8c8fe1f4a128ee0886bbbecf53a5a2ba0048e1785e14b02e0d4fa823b581be9303fb42cc83b38fb598887fcd831917e49a038e5b0d4b6cbf2a5a3071bb093610

Download Submit
memory/1780-55-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1780-44-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1780-28-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2336-6-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

Filesize
4KB

Download
memory/2336-2-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/2336-11-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/2336-10-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2336-9-0x0000000001EC0000-0x0000000001EC1000-memory.dmp

Filesize
4KB

Download
memory/2336-8-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download
memory/2336-7-0x0000000001F30000-0x0000000001F31000-memory.dmp

Filesize
4KB

Download
memory/2336-0-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2336-5-0x0000000001EE0000-0x0000000001EE1000-memory.dmp

Filesize
4KB

Download
memory/2336-4-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

Filesize
4KB

Download
memory/2336-3-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

Filesize
4KB

Download
memory/2336-12-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/2336-13-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/2336-26-0x0000000003C10000-0x0000000003D78000-memory.dmp

Filesize
1.4MB

Download
memory/2336-25-0x0000000003C10000-0x0000000003D78000-memory.dmp

Filesize
1.4MB

Download
memory/2336-14-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/2336-15-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/2336-40-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/2336-41-0x0000000001D30000-0x0000000001D80000-memory.dmp

Filesize
320KB

Download
memory/2336-16-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/2336-1-0x0000000001D30000-0x0000000001D80000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing