modiloader | ed65a0d8566f8485b88c03211f1b2d184a7a5706c4b33e2db73e8c07af58969f

General

Target

JaffaCakes118_0d3b1e8d465ce468924a6c4f165f0148.exe
Size

644KB
MD5

0d3b1e8d465ce468924a6c4f165f0148
SHA1

46dc3818cdf16e22d4326883db48efa7fbd67491
SHA256

ed65a0d8566f8485b88c03211f1b2d184a7a5706c4b33e2db73e8c07af58969f
SHA512

d473483aa31855c46258d98779be3ea9ad5606f1b220c623f8e2028b3ab5492ace6b8e8279bb06d74df88a3654cf345372c8b9ad61b0174a97ef1bdb7375d1e6
SSDEEP

12288:a3JrYf8uXXkM3+7dNCFZxfoxF3Z4mxx/57yYJz8YKR:a3d2vUHWJoxQmX/5Bz8YKR

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/3200-27-0x0000000000400000-0x000000000051E000-memory.dmp	modiloader_stage2
behavioral2/memory/3200-30-0x0000000000400000-0x000000000051E000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\paramstr.txt	JaffaCakes118_0d3b1e8d465ce468924a6c4f165f0148.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3884	3200	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0d3b1e8d465ce468924a6c4f165f0148.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 1196	3200	JaffaCakes118_0d3b1e8d465ce468924a6c4f165f0148.exe	83
PID 3200 wrote to memory of 1196	3200	JaffaCakes118_0d3b1e8d465ce468924a6c4f165f0148.exe	83
PID 3200 wrote to memory of 1196	3200	JaffaCakes118_0d3b1e8d465ce468924a6c4f165f0148.exe	83

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0d3b1e8d465ce468924a6c4f165f0148.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0d3b1e8d465ce468924a6c4f165f0148.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  PID:1196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 616
  2⤵
  - Program crash
  PID:3884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3200 -ip 3200
1⤵
PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3200-0-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3200-1-0x0000000002340000-0x0000000002394000-memory.dmp

Filesize
336KB

Download
memory/3200-3-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/3200-10-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/3200-11-0x00000000034C0000-0x00000000035C0000-memory.dmp

Filesize
1024KB

Download
memory/3200-9-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/3200-8-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/3200-7-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/3200-14-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/3200-6-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/3200-5-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/3200-13-0x00000000034C0000-0x00000000034C3000-memory.dmp

Filesize
12KB

Download
memory/3200-20-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/3200-22-0x0000000003550000-0x0000000003551000-memory.dmp

Filesize
4KB

Download
memory/3200-21-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/3200-19-0x00000000034E0000-0x00000000034E1000-memory.dmp

Filesize
4KB

Download
memory/3200-18-0x00000000034F0000-0x00000000034F1000-memory.dmp

Filesize
4KB

Download
memory/3200-17-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/3200-16-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/3200-15-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/3200-12-0x00000000034D0000-0x00000000034D1000-memory.dmp

Filesize
4KB

Download
memory/3200-4-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/3200-2-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/3200-23-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/3200-25-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/3200-26-0x0000000003530000-0x0000000003531000-memory.dmp

Filesize
4KB

Download
memory/3200-27-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/3200-28-0x0000000002340000-0x0000000002394000-memory.dmp

Filesize
336KB

Download
memory/3200-29-0x00000000034C0000-0x00000000035C0000-memory.dmp

Filesize
1024KB

Download
memory/3200-30-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing