modiloader | 4c0e6cddf93ae8545d0450f80a76808e6ca7191076bcd675be7da8f41b0b8a39

General

Target

JaffaCakes118_5d7e7c18fff93198c9cb94f7cfff2765.exe
Size

632KB
MD5

5d7e7c18fff93198c9cb94f7cfff2765
SHA1

ae7d85360a644a3e8616e36dd3f20f0d0faddd94
SHA256

4c0e6cddf93ae8545d0450f80a76808e6ca7191076bcd675be7da8f41b0b8a39
SHA512

aaa13d9fbeedec09cf7f13d4641e8d2d8a4abc78d84c54ce7be65322331ea2debbce7612cd441f57d6e5883b08f38b082e47d6a8264db92b179c66bea413a939
SSDEEP

12288:THGppUr1tyjaRkG20IqRdCnl80rZG5mMrLF3Z4mxxB9Ou7hB9CsFJKBVMtai0:THqpUZ4jamG1h+trZcmGLQmXBgu7hBoD

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/memory/1804-11-0x0000000003380000-0x0000000003480000-memory.dmp	modiloader_stage2
behavioral1/memory/1804-25-0x0000000000400000-0x0000000000516000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1804 set thread context of 588	1804	JaffaCakes118_5d7e7c18fff93198c9cb94f7cfff2765.exe	30

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt	JaffaCakes118_5d7e7c18fff93198c9cb94f7cfff2765.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5d7e7c18fff93198c9cb94f7cfff2765.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 588	1804	JaffaCakes118_5d7e7c18fff93198c9cb94f7cfff2765.exe	30
PID 1804 wrote to memory of 588	1804	JaffaCakes118_5d7e7c18fff93198c9cb94f7cfff2765.exe	30
PID 1804 wrote to memory of 588	1804	JaffaCakes118_5d7e7c18fff93198c9cb94f7cfff2765.exe	30
PID 1804 wrote to memory of 588	1804	JaffaCakes118_5d7e7c18fff93198c9cb94f7cfff2765.exe	30
PID 1804 wrote to memory of 588	1804	JaffaCakes118_5d7e7c18fff93198c9cb94f7cfff2765.exe	30
PID 1804 wrote to memory of 588	1804	JaffaCakes118_5d7e7c18fff93198c9cb94f7cfff2765.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5d7e7c18fff93198c9cb94f7cfff2765.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5d7e7c18fff93198c9cb94f7cfff2765.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  PID:588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/588-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/588-23-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/588-22-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1804-7-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1804-18-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1804-8-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/1804-0-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1804-6-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1804-5-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/1804-4-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/1804-3-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/1804-13-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/1804-10-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/1804-19-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/1804-9-0x0000000002120000-0x0000000002121000-memory.dmp

Filesize
4KB

Download
memory/1804-11-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/1804-1-0x0000000000980000-0x00000000009D4000-memory.dmp

Filesize
336KB

Download
memory/1804-26-0x0000000000980000-0x00000000009D4000-memory.dmp

Filesize
336KB

Download
memory/1804-25-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/1804-17-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1804-16-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/1804-15-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/1804-14-0x0000000003380000-0x0000000003383000-memory.dmp

Filesize
12KB

Download
memory/1804-2-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing