modiloader | 84254239925e58fd4761fdefe7bb10a688a9b5992cc6651ed31c877a0a0f86e1

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe
Size 730KB
Sample240409-vm9k5agf3s
SHA256 84254239925e58fd4761fdefe7bb10a688a9b5992cc6651ed31c877a0a0f86e1
MD5 ea7c4a52a00d1beb7b2618f19fde3fac
SHA1 c5b433c59f4530855171755721aa1b38c874b388
SHA512 1c02e667da7e5ebee03a0d127579e2e739314c882416d0c90d2e236678c30564dd0941e5e473e1197a275a2adbd11666102ea16c21eb876b8c4be02582e15046
SSDEEP 12288:m+f5DO6fk74BXswsfyX/dPRdKM2UwQL1E4aF3Z4mxx+0MHoTAFbxN9:m0pL87450yvJRdKNUTOQmX+KkN9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 7 IoCs

resource	yara_rule
behavioral2/memory/4924-8-0x0000000000400000-0x00000000004C9000-memory.dmp	modiloader_stage2
behavioral2/memory/4924-13-0x0000000000400000-0x00000000004C9000-memory.dmp	modiloader_stage2
behavioral2/memory/4924-5-0x0000000000400000-0x00000000004C9000-memory.dmp	modiloader_stage2
behavioral2/memory/4924-16-0x0000000000400000-0x00000000004C9000-memory.dmp	modiloader_stage2
behavioral2/memory/4924-35-0x0000000000400000-0x00000000004C9000-memory.dmp	modiloader_stage2
behavioral2/memory/4892-39-0x0000000000400000-0x00000000004C9000-memory.dmp	modiloader_stage2
behavioral2/memory/4892-44-0x0000000000400000-0x00000000004C9000-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

pid	Process
4660	Se101.exe
4892	Se101.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\_Se101.exe	Se101.exe
File created	C:\Windows\SysWOW64\_Se101.exe	Se101.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4772 set thread context of 4924	4772	ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe	86
PID 4660 set thread context of 4892	4660	Se101.exe	90
PID 4892 set thread context of 3024	4892	Se101.exe	93

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Se101.exe	ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Se101.exe	ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.bat	ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4644	4892	WerFault.exe	90
3740	3024	WerFault.exe	93

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4924	4772	ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe	86
PID 4772 wrote to memory of 4924	4772	ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe	86
PID 4772 wrote to memory of 4924	4772	ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe	86
PID 4772 wrote to memory of 4924	4772	ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe	86
PID 4772 wrote to memory of 4924	4772	ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe	86
PID 4924 wrote to memory of 4660	4924	ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe	89
PID 4924 wrote to memory of 4660	4924	ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe	89
PID 4924 wrote to memory of 4660	4924	ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe	89
PID 4660 wrote to memory of 4892	4660	Se101.exe	90
PID 4660 wrote to memory of 4892	4660	Se101.exe	90
PID 4660 wrote to memory of 4892	4660	Se101.exe	90
PID 4660 wrote to memory of 4892	4660	Se101.exe	90
PID 4660 wrote to memory of 4892	4660	Se101.exe	90
PID 4924 wrote to memory of 1712	4924	ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe	92
PID 4924 wrote to memory of 1712	4924	ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe	92
PID 4924 wrote to memory of 1712	4924	ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe	92
PID 4892 wrote to memory of 3024	4892	Se101.exe	93
PID 4892 wrote to memory of 3024	4892	Se101.exe	93
PID 4892 wrote to memory of 3024	4892	Se101.exe	93
PID 4892 wrote to memory of 3024	4892	Se101.exe	93
PID 4892 wrote to memory of 3024	4892	Se101.exe	93
PID 4892 wrote to memory of 1852	4892	Se101.exe	95
PID 4892 wrote to memory of 1852	4892	Se101.exe	95

C:\Users\Admin\AppData\Local\Temp\ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Users\Admin\AppData\Local\Temp\ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ea7c4a52a00d1beb7b2618f19fde3fac_JaffaCakes118.exe
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Program Files\Common Files\Microsoft Shared\MSINFO\Se101.exe
    "C:\Program Files\Common Files\Microsoft Shared\MSINFO\Se101.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Program Files\Common Files\Microsoft Shared\MSINFO\Se101.exe
      "C:\Program Files\Common Files\Microsoft Shared\MSINFO\Se101.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4892
    - - C:\Windows\SysWOW64\calc.exe
        
        "C:\Windows\system32\calc.exe"
        5⤵
        
        PID:3024
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 12
        6⤵
        Program crash
        
        PID:3740
    - - C:\program files\internet explorer\IEXPLORE.EXE
        
        "C:\program files\internet explorer\IEXPLORE.EXE"
        5⤵
        
        PID:1852
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 652
        5⤵
        Program crash
        
        PID:4644
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.bat""
    3⤵
    PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4892 -ip 4892
1⤵
PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3024 -ip 3024
1⤵
PID:1472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

SxingDel.bat

Path C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.bat
Size 212B
SHA256 ee5e593b8d28b3e222690c8fecb0b407c4a67ad2954ad577eceba0f66d284aee
MD5 ffb0ee10c818c3d3283808ea408229db
SHA1 4256c89e80b6fce7f34e51e084402b733650ff4e
SHA512 e8f4e8173668d9fea5658d8d2613fac129678effbeeff2b4e61416dcf572f456f3898a4897e16f00c2cf8f37c5174b49d27298b88a74599144834118079687be
MD5 SHA1 SHA512

Submit Download

Se101.exe

Path C:\Program Files\Common Files\microsoft shared\MSInfo\Se101.exe
Size 730KB
SHA256 84254239925e58fd4761fdefe7bb10a688a9b5992cc6651ed31c877a0a0f86e1
MD5 ea7c4a52a00d1beb7b2618f19fde3fac
SHA1 c5b433c59f4530855171755721aa1b38c874b388
SHA512 1c02e667da7e5ebee03a0d127579e2e739314c882416d0c90d2e236678c30564dd0941e5e473e1197a275a2adbd11666102ea16c21eb876b8c4be02582e15046
SSDEEP 12288:m+f5DO6fk74BXswsfyX/dPRdKM2UwQL1E4aF3Z4mxx+0MHoTAFbxN9:m0pL87450yvJRdKNUTOQmX+KkN9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3024-40-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/4660-26-0x0000000003350000-0x0000000003351000-memory.dmp

Download

memory/4660-33-0x0000000002090000-0x00000000020E4000-memory.dmp

Download

memory/4660-29-0x0000000003340000-0x0000000003341000-memory.dmp

Download

memory/4660-31-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/4660-24-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/4660-23-0x00000000023F0000-0x00000000023F1000-memory.dmp

Download

memory/4660-22-0x0000000002090000-0x00000000020E4000-memory.dmp

Download

memory/4660-21-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/4772-6-0x0000000002460000-0x0000000002461000-memory.dmp

Download

memory/4772-1-0x00000000022C0000-0x0000000002314000-memory.dmp

Download

memory/4772-3-0x0000000002480000-0x0000000002481000-memory.dmp

Download

memory/4772-2-0x00000000024A0000-0x00000000024A1000-memory.dmp

Download

memory/4772-4-0x00000000024D0000-0x00000000024D1000-memory.dmp

Download

memory/4772-9-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/4772-12-0x00000000024B0000-0x00000000024B1000-memory.dmp

Download

memory/4772-11-0x00000000022C0000-0x0000000002314000-memory.dmp

Download

memory/4772-7-0x0000000002450000-0x0000000002451000-memory.dmp

Download

memory/4772-10-0x00000000024C0000-0x00000000024C1000-memory.dmp

Download

memory/4772-0-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/4892-41-0x0000000002250000-0x0000000002251000-memory.dmp

Download

memory/4892-39-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/4892-44-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/4924-8-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/4924-35-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/4924-13-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/4924-16-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/4924-17-0x00000000006B0000-0x00000000006B1000-memory.dmp

Download

memory/4924-5-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads