modiloader | 386cb73f22d568f84e070eced920637f774c221ee1e03732d35497d0082b5577

General

Target

JaffaCakes118_120e4df0c3b744955148c5cb537ba83c.exe
Size

120KB
MD5

120e4df0c3b744955148c5cb537ba83c
SHA1

fa94e085eb5b429d6ece757b40f2c994f0f27b60
SHA256

386cb73f22d568f84e070eced920637f774c221ee1e03732d35497d0082b5577
SHA512

364dc439213a3ea944f370fbe79f8d523665dd6a3ed9831b71a48564ad3394b6594c0932874ac7bac49dd87031aa170beb419f51d935bdfa8ec56c4be6d93dcd
SSDEEP

3072:Z3quyYSRimKjuonB5+UNaAats0Sk7UdFFO8Q4Aov//T:BbSRO/B5+Yatik7wFOgAov

Score

10^/10

modiloader defense_evasion discovery trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral2/memory/3748-48-0x0000000000010000-0x0000000000036000-memory.dmp	modiloader_stage2
behavioral2/memory/4180-47-0x0000000000010000-0x0000000000036000-memory.dmp	modiloader_stage2
behavioral2/memory/3748-50-0x0000000000010000-0x0000000000036000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	JaffaCakes118_120e4df0c3b744955148c5cb537ba83c.exe

Executes dropped EXE 2 IoCs

pid	Process
4180	blade.exe
3748	apocalyps32.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000023b88-7.dat	upx
behavioral2/memory/4180-39-0x0000000000010000-0x0000000000036000-memory.dmp	upx
behavioral2/memory/3748-48-0x0000000000010000-0x0000000000036000-memory.dmp	upx
behavioral2/memory/4180-47-0x0000000000010000-0x0000000000036000-memory.dmp	upx
behavioral2/memory/3748-50-0x0000000000010000-0x0000000000036000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\apocalyps32.exe	blade.exe
File opened for modification	C:\Windows\apocalyps32.exe	blade.exe
File created	C:\Windows\apocalyps32.exe\:Zone.Identifier:$DATA	blade.exe
File created	C:\Windows\apocalyps32.exe	apocalyps32.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\blade.exe:Zone.Identifier	JaffaCakes118_120e4df0c3b744955148c5cb537ba83c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_120e4df0c3b744955148c5cb537ba83c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	blade.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apocalyps32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	JaffaCakes118_120e4df0c3b744955148c5cb537ba83c.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	JaffaCakes118_120e4df0c3b744955148c5cb537ba83c.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\blade.exe:Zone.Identifier	JaffaCakes118_120e4df0c3b744955148c5cb537ba83c.exe
File created	C:\Windows\apocalyps32.exe\:Zone.Identifier:$DATA	blade.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4924	JaffaCakes118_120e4df0c3b744955148c5cb537ba83c.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 4180	4924	JaffaCakes118_120e4df0c3b744955148c5cb537ba83c.exe	83
PID 4924 wrote to memory of 4180	4924	JaffaCakes118_120e4df0c3b744955148c5cb537ba83c.exe	83
PID 4924 wrote to memory of 4180	4924	JaffaCakes118_120e4df0c3b744955148c5cb537ba83c.exe	83
PID 4180 wrote to memory of 3748	4180	blade.exe	92
PID 4180 wrote to memory of 3748	4180	blade.exe	92
PID 4180 wrote to memory of 3748	4180	blade.exe	92
PID 3748 wrote to memory of 3616	3748	apocalyps32.exe	93
PID 3748 wrote to memory of 3616	3748	apocalyps32.exe	93

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_120e4df0c3b744955148c5cb537ba83c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_120e4df0c3b744955148c5cb537ba83c.exe"
1⤵
- Checks computer location settings
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Local\Temp\blade.exe
  "C:\Users\Admin\AppData\Local\Temp\blade.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Windows\apocalyps32.exe
    -bs
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      -bs
      4⤵
      PID:3616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1

T1553

SIP and Trust Provider Hijacking

1

T1553.003

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\blade.exe

Filesize
98KB

MD5
4fca72a253e7724f96461c6a9201e911

SHA1
2254e9485c6cd4ec8b9bfff674722c42eec91c62

SHA256
89da40162e4b4a125adb6d41e0e7c7fbc6f002296bfa8117a63c5b185c15a40b

SHA512
821237eab23f7af79e8b35f83af0cef643bcda6c60bf0c04088ee2c0fda58d1e8772fa8645d9e57a215a984eaf3dde2b6b6911d5b72ce24a07ff4d4d66895dcc

Download Submit
memory/3748-48-0x0000000000010000-0x0000000000036000-memory.dmp

Filesize
152KB

Download
memory/3748-50-0x0000000000010000-0x0000000000036000-memory.dmp

Filesize
152KB

Download
memory/4180-39-0x0000000000010000-0x0000000000036000-memory.dmp

Filesize
152KB

Download
memory/4180-47-0x0000000000010000-0x0000000000036000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing