modiloader | ec5da3fa6ed1992f5675f36f6abceae7aad69f6fa46acf6a2f15ec0963e83813

Analysis

max time kernel
140s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02f9e86539fb0ecd4993caafbe26a41d_JaffaCakes118.exe
Size

1.2MB
MD5

02f9e86539fb0ecd4993caafbe26a41d
SHA1

8d14c24a68b02aa216b45326772b121a5e0ba6fb
SHA256

ec5da3fa6ed1992f5675f36f6abceae7aad69f6fa46acf6a2f15ec0963e83813
SHA512

b64f96f7e42657148a65a7b47afc4df78b15760fc20133cb0cd0a6e159033a8ee30ae2874b0777f07af927223b918aef87ca0407d76b9460bbc77cf72cc99b52
SSDEEP

24576:QZ/jX1ApUYthFIoXSBsGvr06ui9qNJNRQfSkfYPdCY9K0Xdv:QZ/jOGYDFFXStT0LXb/ZeYQYA0Xx

Score

10^/10

modiloader trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4952-24-0x0000000000400000-0x0000000000522000-memory.dmp	modiloader_stage2
behavioral2/memory/4260-28-0x0000000076080000-0x0000000076170000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

02f9e86539fb0ecd4993caafbe26a41d_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	02f9e86539fb0ecd4993caafbe26a41d_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

Processes:

Kyng_Share_Tool_v100_RC1.exe

pid process

4260 Kyng_Share_Tool_v100_RC1.exe

pid	process
4260	Kyng_Share_Tool_v100_RC1.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Kyng_Share_Tool_v100_RC1.exe	upx
behavioral2/memory/4260-25-0x0000000000400000-0x0000000000681000-memory.dmp	upx
behavioral2/memory/4260-32-0x0000000000400000-0x0000000000681000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

02f9e86539fb0ecd4993caafbe26a41d_JaffaCakes118.exe

description	pid	process	target process
PID 4952 wrote to memory of 4260	4952	02f9e86539fb0ecd4993caafbe26a41d_JaffaCakes118.exe	Kyng_Share_Tool_v100_RC1.exe
PID 4952 wrote to memory of 4260	4952	02f9e86539fb0ecd4993caafbe26a41d_JaffaCakes118.exe	Kyng_Share_Tool_v100_RC1.exe
PID 4952 wrote to memory of 4260	4952	02f9e86539fb0ecd4993caafbe26a41d_JaffaCakes118.exe	Kyng_Share_Tool_v100_RC1.exe

C:\Users\Admin\AppData\Local\Temp\02f9e86539fb0ecd4993caafbe26a41d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02f9e86539fb0ecd4993caafbe26a41d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4952

C:\Users\Admin\AppData\Local\Temp\Kyng_Share_Tool_v100_RC1.exe
"C:\Users\Admin\AppData\Local\Temp\Kyng_Share_Tool_v100_RC1.exe"
2⤵
- Executes dropped EXE
PID:4260

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Kyng_Share_Tool_v100_RC1.exe
Filesize
911KB

MD5
b177e11c598bc1f2af832e9aa021739e

SHA1
c5800c4ed6d0f6b3548e239e2218ce2045487ab1

SHA256
a20237911e7115f8526cf7e7f996600d68c7b226a86f714d8a3b2294cac148c7

SHA512
54e8b2a77e24ff454b3a1657ea9e46780a0b5a3807a73edcdd93972d78dd3842b20d6e32e0e7178b8d53e85ff2ee9eefc34a8b205a690a57239bcb41215f9271

Download Submit
memory/4260-32-0x0000000000400000-0x0000000000681000-memory.dmp

Filesize
2.5MB

Download
memory/4260-33-0x0000000076080000-0x0000000076170000-memory.dmp

Filesize
960KB

Download
memory/4260-31-0x0000000076080000-0x0000000076170000-memory.dmp

Filesize
960KB

Download
memory/4260-28-0x0000000076080000-0x0000000076170000-memory.dmp

Filesize
960KB

Download
memory/4260-29-0x0000000076080000-0x0000000076170000-memory.dmp

Filesize
960KB

Download
memory/4260-25-0x0000000000400000-0x0000000000681000-memory.dmp

Filesize
2.5MB

Download
memory/4952-9-0x0000000076080000-0x0000000076170000-memory.dmp

Filesize
960KB

Download
memory/4952-26-0x0000000076080000-0x0000000076170000-memory.dmp

Filesize
960KB

Download
memory/4952-2-0x00000000021A0000-0x00000000021EE000-memory.dmp

Filesize
312KB

Download
memory/4952-1-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/4952-6-0x00000000760A0000-0x00000000760A1000-memory.dmp

Filesize
4KB

Download
memory/4952-4-0x0000000002440000-0x0000000002450000-memory.dmp

Filesize
64KB

Download
memory/4952-27-0x00000000021A0000-0x00000000021EE000-memory.dmp

Filesize
312KB

Download
memory/4952-3-0x00000000009C0000-0x00000000009D0000-memory.dmp

Filesize
64KB

Download
memory/4952-5-0x0000000077B22000-0x0000000077B23000-memory.dmp

Filesize
4KB

Download
memory/4952-24-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/4952-0-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/4952-10-0x0000000076080000-0x0000000076170000-memory.dmp

Filesize
960KB

Download
memory/4952-12-0x0000000076080000-0x0000000076170000-memory.dmp

Filesize
960KB

Download
memory/4952-8-0x0000000076080000-0x0000000076170000-memory.dmp

Filesize
960KB

Download
memory/4952-7-0x0000000076080000-0x0000000076170000-memory.dmp

Filesize
960KB

Download