modiloader | d29b0556e49fe17164f0f3e0016b9e5083ec1627c1d0406dd431659470ef6303

General

Target

JaffaCakes118_d29b0556e49fe17164f0f3e0016b9e5083ec1627c1d0406dd431659470ef6303.exe
Size

967KB
MD5

d55a0b188884ef45eeef7dda636a6b62
SHA1

cb7d509630dc72b29df21b17331a6db91989e65f
SHA256

d29b0556e49fe17164f0f3e0016b9e5083ec1627c1d0406dd431659470ef6303
SHA512

ec1f489936b45faf27e761cb15efa3f11ea11c7d526a42ac831a7431ca0898f8975643ce7c60e1ddd8ccbe6f55a4c13c7630368284de39084eb6737c415ab7a1
SSDEEP

24576:1rNcbqhAPsRd94ccC1cKgTcn5SMVh9+p2u:RfhAkhXcC2KgTESuzm2

Score

10^/10

modiloader bootkit discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader First Stage 4 IoCs

resource	yara_rule
behavioral2/memory/2824-24-0x0000000000AB0000-0x0000000000B0A000-memory.dmp	modiloader_stage1
behavioral2/memory/2824-27-0x0000000000AB0000-0x0000000000B0A000-memory.dmp	modiloader_stage1
behavioral2/memory/2824-28-0x0000000000AB0000-0x0000000000B0A000-memory.dmp	modiloader_stage1
behavioral2/memory/2824-29-0x0000000000AB0000-0x0000000000B0A000-memory.dmp	modiloader_stage1

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oskdsfzynC.url	Benedetto.exe.com

Executes dropped EXE 3 IoCs

pid	Process
1520	Benedetto.exe.com
5036	Benedetto.exe.com
2824	Benedetto.exe.com

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	JaffaCakes118_d29b0556e49fe17164f0f3e0016b9e5083ec1627c1d0406dd431659470ef6303.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Benedetto.exe.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5036 set thread context of 2824	5036	Benedetto.exe.com	92

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Benedetto.exe.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Benedetto.exe.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Benedetto.exe.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_d29b0556e49fe17164f0f3e0016b9e5083ec1627c1d0406dd431659470ef6303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4816	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4816	PING.EXE

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1520	Benedetto.exe.com
1520	Benedetto.exe.com
1520	Benedetto.exe.com
5036	Benedetto.exe.com
5036	Benedetto.exe.com
5036	Benedetto.exe.com

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1520	Benedetto.exe.com
1520	Benedetto.exe.com
1520	Benedetto.exe.com
5036	Benedetto.exe.com
5036	Benedetto.exe.com
5036	Benedetto.exe.com

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 4316	1796	JaffaCakes118_d29b0556e49fe17164f0f3e0016b9e5083ec1627c1d0406dd431659470ef6303.exe	83
PID 1796 wrote to memory of 4316	1796	JaffaCakes118_d29b0556e49fe17164f0f3e0016b9e5083ec1627c1d0406dd431659470ef6303.exe	83
PID 1796 wrote to memory of 4316	1796	JaffaCakes118_d29b0556e49fe17164f0f3e0016b9e5083ec1627c1d0406dd431659470ef6303.exe	83
PID 1796 wrote to memory of 4464	1796	JaffaCakes118_d29b0556e49fe17164f0f3e0016b9e5083ec1627c1d0406dd431659470ef6303.exe	85
PID 1796 wrote to memory of 4464	1796	JaffaCakes118_d29b0556e49fe17164f0f3e0016b9e5083ec1627c1d0406dd431659470ef6303.exe	85
PID 1796 wrote to memory of 4464	1796	JaffaCakes118_d29b0556e49fe17164f0f3e0016b9e5083ec1627c1d0406dd431659470ef6303.exe	85
PID 4464 wrote to memory of 2024	4464	cmd.exe	87
PID 4464 wrote to memory of 2024	4464	cmd.exe	87
PID 4464 wrote to memory of 2024	4464	cmd.exe	87
PID 2024 wrote to memory of 3784	2024	cmd.exe	88
PID 2024 wrote to memory of 3784	2024	cmd.exe	88
PID 2024 wrote to memory of 3784	2024	cmd.exe	88
PID 2024 wrote to memory of 1520	2024	cmd.exe	89
PID 2024 wrote to memory of 1520	2024	cmd.exe	89
PID 2024 wrote to memory of 1520	2024	cmd.exe	89
PID 2024 wrote to memory of 4816	2024	cmd.exe	90
PID 2024 wrote to memory of 4816	2024	cmd.exe	90
PID 2024 wrote to memory of 4816	2024	cmd.exe	90
PID 1520 wrote to memory of 5036	1520	Benedetto.exe.com	91
PID 1520 wrote to memory of 5036	1520	Benedetto.exe.com	91
PID 1520 wrote to memory of 5036	1520	Benedetto.exe.com	91
PID 5036 wrote to memory of 2824	5036	Benedetto.exe.com	92
PID 5036 wrote to memory of 2824	5036	Benedetto.exe.com	92
PID 5036 wrote to memory of 2824	5036	Benedetto.exe.com	92
PID 5036 wrote to memory of 2824	5036	Benedetto.exe.com	92
PID 5036 wrote to memory of 2824	5036	Benedetto.exe.com	92

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d29b0556e49fe17164f0f3e0016b9e5083ec1627c1d0406dd431659470ef6303.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d29b0556e49fe17164f0f3e0016b9e5083ec1627c1d0406dd431659470ef6303.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\expand.exe
  expand
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4316
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Sogni.xlm
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^RLOwHDcqeFrExqUNHlxnLMRVxwYxcqWVXNHUzuvYvVIaWxirXweuhnntUTGFEqEeIiGGzqzANvwPtnZqUVbzXQHmfCZAA$" Una.xlm
      4⤵
      System Location Discovery: System Language Discovery
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Benedetto.exe.com
      Benedetto.exe.com C
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Benedetto.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Benedetto.exe.com C
        5⤵
        Drops startup file
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Benedetto.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Benedetto.exe.com
        6⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        
        PID:2824
  - - C:\Windows\SysWOW64\PING.EXE
      ping UTKBEBLO
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Remote System Discovery

1

T1018

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Benedetto.exe.com

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ricordate.xlm

Filesize
1.0MB

MD5
0d632f2cd30bb58747564d2ccba56852

SHA1
8354e1cce0ae7f5e5c010fd8d8fc95d4f6a7bf25

SHA256
427e7cb763a791d9ecdbb504ccd1066b48fd5c212de79665fc2d2fcaa19520e1

SHA512
6806d273b0e8af1a38929883dbe52004039b49a04638af98346025bffbb909f219ab4d5013320cfee5714739121b2854bfda46810c5b1aad360599b63ae360af

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sogni.xlm

Filesize
318B

MD5
721eabbca90b2cdf19185a23ecbf3fc8

SHA1
02a254933b860ed7c86625c897f4de22734e2469

SHA256
433daa4dfba2f4b083d913945e8ac4c29fc235af4878396f7fc9b4e97e6c7ae4

SHA512
11ca0a578362f72cc5ef293b4cb0d7454eeb8b55fb4a6eb4c939809fa06aa78bf9402266e7e9995bd3e78de922105d9adcf03cb3eabc07d3f30bac46b226463a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Una.xlm

Filesize
872KB

MD5
0e6979e856547f4ab1c2ebb842d7d5f3

SHA1
7849fb74f845eea33a235552777f6882dd74bbae

SHA256
beda2839edc3179065dcad7d6cd4a9f68e1fb0e0bc41b0baf07d4ad7b159050c

SHA512
83ba7bd80b6ad21fb10a5f2f0b52f9b37c6874c3a84ba2aa4c9649a7038c7890f7222c925a608d9cfd4f81b420a2a587c12a5f29c8c0b93f4e39550d2ad3f554

Download Submit
memory/2824-24-0x0000000000AB0000-0x0000000000B0A000-memory.dmp

Filesize
360KB

Download
memory/2824-27-0x0000000000AB0000-0x0000000000B0A000-memory.dmp

Filesize
360KB

Download
memory/2824-28-0x0000000000AB0000-0x0000000000B0A000-memory.dmp

Filesize
360KB

Download
memory/2824-29-0x0000000000AB0000-0x0000000000B0A000-memory.dmp

Filesize
360KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads