modiloader | a427397e18893f2d908b49ef7804cbb2f18e6e4a6181589827cb28a357dba29c

General

Target

JaffaCakes118_c74decd48d690808fe82f2c16efd78eb.exe
Size

721KB
MD5

c74decd48d690808fe82f2c16efd78eb
SHA1

1039bd4ed11ca2416ad610d822f8b98dc5cf37e8
SHA256

a427397e18893f2d908b49ef7804cbb2f18e6e4a6181589827cb28a357dba29c
SHA512

d62b1a076b254ebfe17f29fefef5d61dddfe5d769f25978b8d77f2c8939b13cde7abc9d4d3a059b7680f9a8e1543da63ec2f43d21f0cd5e6887b4986483ab988
SSDEEP

12288:fc//////PWito1RuQzBhsLu/6C4/fPc5LAivvfkOAnzOaj2OjRHhLo8yfDzX:fc//////PmucBhsLugfPc5HnfkpzOaNy

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001226d-4.dat	modiloader_stage2
behavioral1/memory/2256-33-0x0000000000400000-0x00000000004BF000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
2324	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2256	Sx_server.exe

Loads dropped DLL 1 IoCs

pid	Process
2336	cmd.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\2010.txt	Sx_server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c74decd48d690808fe82f2c16efd78eb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sx_server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2336	2076	JaffaCakes118_c74decd48d690808fe82f2c16efd78eb.exe	30
PID 2076 wrote to memory of 2336	2076	JaffaCakes118_c74decd48d690808fe82f2c16efd78eb.exe	30
PID 2076 wrote to memory of 2336	2076	JaffaCakes118_c74decd48d690808fe82f2c16efd78eb.exe	30
PID 2076 wrote to memory of 2336	2076	JaffaCakes118_c74decd48d690808fe82f2c16efd78eb.exe	30
PID 2076 wrote to memory of 2576	2076	JaffaCakes118_c74decd48d690808fe82f2c16efd78eb.exe	31
PID 2076 wrote to memory of 2576	2076	JaffaCakes118_c74decd48d690808fe82f2c16efd78eb.exe	31
PID 2076 wrote to memory of 2576	2076	JaffaCakes118_c74decd48d690808fe82f2c16efd78eb.exe	31
PID 2076 wrote to memory of 2576	2076	JaffaCakes118_c74decd48d690808fe82f2c16efd78eb.exe	31
PID 2076 wrote to memory of 2324	2076	JaffaCakes118_c74decd48d690808fe82f2c16efd78eb.exe	32
PID 2076 wrote to memory of 2324	2076	JaffaCakes118_c74decd48d690808fe82f2c16efd78eb.exe	32
PID 2076 wrote to memory of 2324	2076	JaffaCakes118_c74decd48d690808fe82f2c16efd78eb.exe	32
PID 2076 wrote to memory of 2324	2076	JaffaCakes118_c74decd48d690808fe82f2c16efd78eb.exe	32
PID 2336 wrote to memory of 2256	2336	cmd.exe	36
PID 2336 wrote to memory of 2256	2336	cmd.exe	36
PID 2336 wrote to memory of 2256	2336	cmd.exe	36
PID 2336 wrote to memory of 2256	2336	cmd.exe	36
PID 2576 wrote to memory of 3028	2576	cmd.exe	37
PID 2576 wrote to memory of 3028	2576	cmd.exe	37
PID 2576 wrote to memory of 3028	2576	cmd.exe	37
PID 2576 wrote to memory of 3028	2576	cmd.exe	37
PID 2256 wrote to memory of 2316	2256	Sx_server.exe	38
PID 2256 wrote to memory of 2316	2256	Sx_server.exe	38
PID 2256 wrote to memory of 2316	2256	Sx_server.exe	38
PID 2256 wrote to memory of 2316	2256	Sx_server.exe	38

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c74decd48d690808fe82f2c16efd78eb.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c74decd48d690808fe82f2c16efd78eb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\Sx_server.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Users\Admin\AppData\Local\Temp\Sx_server.exe
    C:\Users\Admin\AppData\Local\Temp\Sx_server.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\program files\internet explorer\IEXPLORE.EXE
      "C:\program files\internet explorer\IEXPLORE.EXE"
      4⤵
      PID:2316
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\Èí¼þÊ¹ÓÃËµÃ÷.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Èí¼þÊ¹ÓÃËµÃ÷.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c74decd48d690808fe82f2c16efd78eb.exe"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Èí¼þÊ¹ÓÃËµÃ÷.txt

Filesize
2KB

MD5
92791113b8b4448f94d1f9d5670a991d

SHA1
f397f44b9110c26a4134fc2d1703665403be1ae6

SHA256
d2d3930a7ccf585ec5e06b105f9e2df3e67afc56de55cbfabb9dab87c94652af

SHA512
b8963534c8a94e6de684371d09deed5952013f2faae1bad96bf7158e3a7088b30a188b558b7e24254d9141d6c6966bf002354eb0e8b35b97ca7f3b35f06d313d

Download Submit
\Users\Admin\AppData\Local\Temp\Sx_server.exe

Filesize
685KB

MD5
20b4f6b39155b033e534e21bcd3a5a2f

SHA1
4f1ad2d078420e68d8d1e01fc23191265bdb69ae

SHA256
a91360bbd6fe4b19221ef487ddae25cb2ed7ce58044de6c555158fac6f8ef1cc

SHA512
934f887576256aa09d9af5b6030bb15e579e91201f62028d1d8eaa61acae8df741b84645efefd993488c3f29fea197c48433c9d376305539571aa09f3cb36837

Download Submit
memory/2076-2-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2256-28-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2256-33-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download

Analysis

Sharing