modiloader | 9f82ea1562d67600b8c4dc40bb90221b250c5dbc636574697852e72ba0eb5a0d

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
Size

619KB
MD5

0499f4fb4c2f0288a58d8da7194ee1f2
SHA1

a021130a03ab224e048afd58117527393c712af4
SHA256

9f82ea1562d67600b8c4dc40bb90221b250c5dbc636574697852e72ba0eb5a0d
SHA512

1d1f8bd32db584a0134a667402171ec1c6c93388882c1a2cfa34b6d37c37fc5610efe82e701c6b6fdab84de5a89c9def7c78f85026160ef0b95b2f6046015367
SSDEEP

12288:vDoEgXcHpXwLT/2rL/Kn+fa/ysR8HrydpGomF3Z4mxxRDqVTVOC/:vDyXmpA//ALin+fa/ULyiQmXYVTz/

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2444-73-0x0000000000400000-0x0000000000569000-memory.dmp	modiloader_stage2
behavioral2/memory/4188-87-0x0000000000400000-0x0000000000569000-memory.dmp	modiloader_stage2
behavioral2/memory/4188-90-0x0000000000400000-0x0000000000569000-memory.dmp	modiloader_stage2
behavioral2/memory/2444-92-0x0000000000400000-0x0000000000569000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

rej.exe

pid process

4188 rej.exe

pid	process
4188	rej.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\H:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\Z:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\Q:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\T:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\U:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\K:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\M:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\O:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\P:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\V:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\G:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\N:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\R:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\S:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\J:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\L:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\W:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\X:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\A:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\B:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\E:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\I:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened (read-only)	\??\Y:	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe

description	ioc	process
File created	C:\AutoRun.inf	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened for modification	C:\AutoRun.inf	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File created	F:\AutoRun.inf	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened for modification	F:\AutoRun.inf	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

Processes:

0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exerej.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rej.exe	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rej.exe	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rej.exe	rej.exe
File created	C:\Windows\SysWOW64\DelSvel.bat	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe

description	pid	process	target process
PID 2444 wrote to memory of 4188	2444	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe	rej.exe
PID 2444 wrote to memory of 4188	2444	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe	rej.exe
PID 2444 wrote to memory of 4188	2444	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe	rej.exe
PID 2444 wrote to memory of 5032	2444	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe	cmd.exe
PID 2444 wrote to memory of 5032	2444	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe	cmd.exe
PID 2444 wrote to memory of 5032	2444	0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0499f4fb4c2f0288a58d8da7194ee1f2_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\rej.exe
  C:\Windows\system32\rej.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:4188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\DelSvel.bat
  2⤵
  PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\DelSvel.bat

Filesize
212B

MD5
a01c2cfa989c25f59675cd56d9f893b1

SHA1
346863681f448fe40c3a4890dd64069acbde1e14

SHA256
7a6c7511e86f3fed40a5a979ed19c929cae49123386a8160ead1c221330092f4

SHA512
a2c763db9d3478033af9d823cded89ead6b75142e330840fc99aa01bf6ae2fe9f7c43aa54f0ac55038f581f840330de8bc570e3bab3f98386b18166abd0d6af2

Download Submit
F:\rej.exe

Filesize
619KB

MD5
0499f4fb4c2f0288a58d8da7194ee1f2

SHA1
a021130a03ab224e048afd58117527393c712af4

SHA256
9f82ea1562d67600b8c4dc40bb90221b250c5dbc636574697852e72ba0eb5a0d

SHA512
1d1f8bd32db584a0134a667402171ec1c6c93388882c1a2cfa34b6d37c37fc5610efe82e701c6b6fdab84de5a89c9def7c78f85026160ef0b95b2f6046015367

Download Submit
memory/2444-0-0x0000000000400000-0x0000000000569000-memory.dmp

Filesize
1.4MB

Download
memory/2444-3-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/2444-17-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-72-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-71-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-70-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-69-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-68-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-67-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-66-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-65-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-64-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-63-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-62-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-4-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/2444-61-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-60-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-59-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-58-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-57-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-56-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-55-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-54-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-53-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-52-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-51-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-50-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-49-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-48-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-47-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-46-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-45-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-44-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-43-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-42-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-41-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-40-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-39-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-38-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-37-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-36-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-35-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-34-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-33-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-32-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-31-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-30-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-29-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-28-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-27-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-26-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-25-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-24-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-23-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-22-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-21-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-20-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-19-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-18-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2444-16-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2444-15-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2444-14-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2444-13-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2444-12-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2444-11-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2444-10-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/2444-9-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/2444-8-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/2444-7-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/2444-6-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/2444-5-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/2444-2-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/2444-1-0x0000000002370000-0x00000000023C4000-memory.dmp

Filesize
336KB

Download
memory/2444-73-0x0000000000400000-0x0000000000569000-memory.dmp

Filesize
1.4MB

Download
memory/2444-92-0x0000000000400000-0x0000000000569000-memory.dmp

Filesize
1.4MB

Download
memory/2444-93-0x0000000002370000-0x00000000023C4000-memory.dmp

Filesize
336KB

Download
memory/4188-87-0x0000000000400000-0x0000000000569000-memory.dmp

Filesize
1.4MB

Download
memory/4188-90-0x0000000000400000-0x0000000000569000-memory.dmp

Filesize
1.4MB

Download