modiloader | a87e0bcdd4799e3fe4e194dc01e5526cf2b7a249ff2e4406aa353c0c0dea0bf3

General

Target

JaffaCakes118_0e3a331bd3cd562bf4473d42eb9a5707.exe
Size

599KB
MD5

0e3a331bd3cd562bf4473d42eb9a5707
SHA1

22e58180a8f93130efa4b71c6ae042711d2012b5
SHA256

a87e0bcdd4799e3fe4e194dc01e5526cf2b7a249ff2e4406aa353c0c0dea0bf3
SHA512

4d2a4ca9ad686780e257025f8a1d206f0aae701b3c709d543fb43438a0d98eee80ce1be90b337bc026079b16718d186f286add8bbbece69e180281052bcd86cf
SSDEEP

12288:EhEVFbsPUnGAFeB1lOy6m7Ha96V4F3Z4mxx0e1zbUFEx7J:EeUPUGAwB18m7Q6V4QmX0e9bqEH

Score

10^/10

modiloader aspackv2 discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral1/memory/3032-30-0x0000000000400000-0x0000000000513000-memory.dmp	modiloader_stage2
behavioral1/memory/3032-45-0x0000000000400000-0x0000000000513000-memory.dmp	modiloader_stage2
behavioral1/memory/2500-47-0x0000000000400000-0x0000000000513000-memory.dmp	modiloader_stage2
behavioral1/memory/2500-48-0x0000000000400000-0x0000000000513000-memory.dmp	modiloader_stage2

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000b000000012280-26.dat	aspack_v212_v242

Deletes itself 1 IoCs

pid	Process
2944	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2500	smss.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_smss.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\_smss.exe	smss.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\smss.exe	JaffaCakes118_0e3a331bd3cd562bf4473d42eb9a5707.exe
File opened for modification	C:\Windows\smss.exe	JaffaCakes118_0e3a331bd3cd562bf4473d42eb9a5707.exe
File created	C:\Windows\ReDelBat.bat	JaffaCakes118_0e3a331bd3cd562bf4473d42eb9a5707.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2484	2500	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0e3a331bd3cd562bf4473d42eb9a5707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2500	3032	JaffaCakes118_0e3a331bd3cd562bf4473d42eb9a5707.exe	30
PID 3032 wrote to memory of 2500	3032	JaffaCakes118_0e3a331bd3cd562bf4473d42eb9a5707.exe	30
PID 3032 wrote to memory of 2500	3032	JaffaCakes118_0e3a331bd3cd562bf4473d42eb9a5707.exe	30
PID 3032 wrote to memory of 2500	3032	JaffaCakes118_0e3a331bd3cd562bf4473d42eb9a5707.exe	30
PID 2500 wrote to memory of 2484	2500	smss.exe	31
PID 2500 wrote to memory of 2484	2500	smss.exe	31
PID 2500 wrote to memory of 2484	2500	smss.exe	31
PID 2500 wrote to memory of 2484	2500	smss.exe	31
PID 3032 wrote to memory of 2944	3032	JaffaCakes118_0e3a331bd3cd562bf4473d42eb9a5707.exe	33
PID 3032 wrote to memory of 2944	3032	JaffaCakes118_0e3a331bd3cd562bf4473d42eb9a5707.exe	33
PID 3032 wrote to memory of 2944	3032	JaffaCakes118_0e3a331bd3cd562bf4473d42eb9a5707.exe	33
PID 3032 wrote to memory of 2944	3032	JaffaCakes118_0e3a331bd3cd562bf4473d42eb9a5707.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0e3a331bd3cd562bf4473d42eb9a5707.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0e3a331bd3cd562bf4473d42eb9a5707.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\smss.exe
  C:\Windows\smss.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 300
    3⤵
    - Program crash
    PID:2484
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\ReDelBat.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\ReDelBat.bat

Filesize
212B

MD5
153d9ee3ef1420fa68e2eb19639aada6

SHA1
08d98e597a593fa780faf36dc3a8d7d60a4f8b3c

SHA256
09e56f33a6459d27778144e43ad6fb9013f51eaa11a7a4d319932e46d2d47ad2

SHA512
e5fe5e1012ce34fbaf8f4e9dc474e7adc0870b557c74b6a07ac57088631f5664cafb1e84e1f670326af7865d7c0d35adb98de6cb3600642ec53664d3bb125497

Download Submit
C:\Windows\smss.exe

Filesize
599KB

MD5
0e3a331bd3cd562bf4473d42eb9a5707

SHA1
22e58180a8f93130efa4b71c6ae042711d2012b5

SHA256
a87e0bcdd4799e3fe4e194dc01e5526cf2b7a249ff2e4406aa353c0c0dea0bf3

SHA512
4d2a4ca9ad686780e257025f8a1d206f0aae701b3c709d543fb43438a0d98eee80ce1be90b337bc026079b16718d186f286add8bbbece69e180281052bcd86cf

Download Submit
memory/2500-48-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2500-47-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2500-29-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/3032-5-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/3032-3-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/3032-14-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/3032-13-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/3032-12-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/3032-11-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/3032-10-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/3032-9-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

Filesize
4KB

Download
memory/3032-8-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

Filesize
4KB

Download
memory/3032-7-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download
memory/3032-6-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/3032-1-0x0000000001D20000-0x0000000001D74000-memory.dmp

Filesize
336KB

Download
memory/3032-4-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/3032-15-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/3032-2-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/3032-16-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/3032-27-0x00000000043C0000-0x00000000044D3000-memory.dmp

Filesize
1.1MB

Download
memory/3032-30-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/3032-17-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/3032-28-0x00000000043C0000-0x00000000044D3000-memory.dmp

Filesize
1.1MB

Download
memory/3032-35-0x0000000001D20000-0x0000000001D74000-memory.dmp

Filesize
336KB

Download
memory/3032-36-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/3032-37-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/3032-18-0x0000000003230000-0x0000000003231000-memory.dmp

Filesize
4KB

Download
memory/3032-45-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/3032-19-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/3032-0-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing