modiloader | e0912d7f0f40b32c82157922b2358a7e12824d0c0351a0671b7baf2f21edf28a

General

Target

JaffaCakes118_0470af82be89a7ca16628a3750453401.exe
Size

640KB
MD5

0470af82be89a7ca16628a3750453401
SHA1

8eeb97aeb8ebb41b63650659a55d88c6f7ad92b7
SHA256

e0912d7f0f40b32c82157922b2358a7e12824d0c0351a0671b7baf2f21edf28a
SHA512

9e43deede1d408f7fc4918ae08225482c2eedfd96a93542aab1b565bca01a10359b50e8ac56f5e278ed54850136585a68ecfad7f4cf420560c69bf3db908c4e2
SSDEEP

12288:R4C1xb9p/uc66E2ksUEVXUgP6E/i2r/NINv5MNf7CYvQTbi6MD3Ae8+zruilcr4z:R3CCVXUgPw2r/NINyNfxvQTberpzK69F

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/796-31-0x0000000000400000-0x000000000051A000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 796 set thread context of 2936	796	JaffaCakes118_0470af82be89a7ca16628a3750453401.exe	29

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\paramstr.txt	JaffaCakes118_0470af82be89a7ca16628a3750453401.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0470af82be89a7ca16628a3750453401.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 2936	796	JaffaCakes118_0470af82be89a7ca16628a3750453401.exe	29
PID 796 wrote to memory of 2936	796	JaffaCakes118_0470af82be89a7ca16628a3750453401.exe	29
PID 796 wrote to memory of 2936	796	JaffaCakes118_0470af82be89a7ca16628a3750453401.exe	29
PID 796 wrote to memory of 2936	796	JaffaCakes118_0470af82be89a7ca16628a3750453401.exe	29
PID 796 wrote to memory of 2936	796	JaffaCakes118_0470af82be89a7ca16628a3750453401.exe	29
PID 796 wrote to memory of 2936	796	JaffaCakes118_0470af82be89a7ca16628a3750453401.exe	29

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0470af82be89a7ca16628a3750453401.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0470af82be89a7ca16628a3750453401.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\SysWOW64\mspaint.exe
  "C:\Windows\system32\mspaint.exe"
  2⤵
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/796-13-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/796-5-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/796-0-0x0000000000390000-0x00000000003E4000-memory.dmp

Filesize
336KB

Download
memory/796-24-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/796-23-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/796-22-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/796-21-0x00000000033B0000-0x00000000033B1000-memory.dmp

Filesize
4KB

Download
memory/796-20-0x0000000003360000-0x0000000003363000-memory.dmp

Filesize
12KB

Download
memory/796-19-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/796-18-0x0000000003460000-0x0000000003461000-memory.dmp

Filesize
4KB

Download
memory/796-17-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/796-16-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/796-15-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/796-14-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/796-25-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/796-12-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/796-1-0x00000000020C0000-0x00000000020C1000-memory.dmp

Filesize
4KB

Download
memory/796-10-0x0000000003360000-0x0000000003460000-memory.dmp

Filesize
1024KB

Download
memory/796-9-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/796-8-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/796-7-0x00000000020D0000-0x00000000020D1000-memory.dmp

Filesize
4KB

Download
memory/796-6-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/796-11-0x0000000003370000-0x0000000003371000-memory.dmp

Filesize
4KB

Download
memory/796-4-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/796-3-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/796-2-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/796-31-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/796-32-0x0000000000390000-0x00000000003E4000-memory.dmp

Filesize
336KB

Download
memory/2936-29-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download
memory/2936-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2936-30-0x0000000000400000-0x000000000051A000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing