modiloader | def80d52865a8f5abe1a54989c9869c456f8c2d9722a82dde46f0822ce403977

Analysis

max time kernel
145s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 18:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe
Size 464KB
Sample240620-xhzapssekf
SHA256 def80d52865a8f5abe1a54989c9869c456f8c2d9722a82dde46f0822ce403977
MD5 08d2170af43c86ed97d0dac1ff5dda13
SHA1 1a392945351dcf710e5ff89bbd84e4ca0042d018
SHA512 1f5920c454955f939d2c8be06282a48342b70fd9c2c5f110ec1fa2c3e94d254192404218a1c0608dd5351c8794155ada85a0b2d964f53448a2b846ebf32fab6a
SSDEEP 6144:VGfbCSJRNESQN53Bf/SWCjNW5uo5McluV67JAI58JLexotC+PrrBO8FL02QFWz/t:gEr93Co5uo2hQKJ20s8F42mSVUDu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 5 IoCs

resource	yara_rule
behavioral2/memory/4816-3-0x0000000000400000-0x000000000053B000-memory.dmp	modiloader_stage2
behavioral2/memory/4496-13-0x0000000000400000-0x000000000053B000-memory.dmp	modiloader_stage2
behavioral2/memory/4816-18-0x0000000000400000-0x000000000053B000-memory.dmp	modiloader_stage2
behavioral2/memory/4496-22-0x0000000000400000-0x000000000053B000-memory.dmp	modiloader_stage2
behavioral2/memory/4496-25-0x0000000000400000-0x000000000053B000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
4496	rejoice813.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\_rejoice813.exe	rejoice813.exe
File created	C:\Windows\SysWOW64\_rejoice813.exe	rejoice813.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 4496 set thread context of 2976	4496	rejoice813.exe	86
PID 4496 set thread context of 1464	4496	rejoice813.exe	93
PID 4496 set thread context of 392	4496	rejoice813.exe	109
PID 4496 set thread context of 4580	4496	rejoice813.exe	113
PID 4496 set thread context of 4976	4496	rejoice813.exe	116
PID 4496 set thread context of 4520	4496	rejoice813.exe	119
PID 4496 set thread context of 3056	4496	rejoice813.exe	122
PID 4496 set thread context of 1084	4496	rejoice813.exe	126

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat	08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice813.exe	08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice813.exe	08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
1032	2976	WerFault.exe	86
632	1464	WerFault.exe	93
2256	4296	WerFault.exe	104
3184	392	WerFault.exe	109
4652	4580	WerFault.exe	113
4984	4976	WerFault.exe	116
3416	4520	WerFault.exe	119
1768	3056	WerFault.exe	122
2952	1084	WerFault.exe	126

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2976	calc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 4496	4816	08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe	85
PID 4816 wrote to memory of 4496	4816	08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe	85
PID 4816 wrote to memory of 4496	4816	08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe	85
PID 4496 wrote to memory of 2976	4496	rejoice813.exe	86
PID 4496 wrote to memory of 2976	4496	rejoice813.exe	86
PID 4496 wrote to memory of 2976	4496	rejoice813.exe	86
PID 4496 wrote to memory of 2976	4496	rejoice813.exe	86
PID 4496 wrote to memory of 2976	4496	rejoice813.exe	86
PID 4816 wrote to memory of 2496	4816	08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe	88
PID 4816 wrote to memory of 2496	4816	08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe	88
PID 4816 wrote to memory of 2496	4816	08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe	88
PID 4496 wrote to memory of 3136	4496	rejoice813.exe	92
PID 4496 wrote to memory of 3136	4496	rejoice813.exe	92
PID 4496 wrote to memory of 3136	4496	rejoice813.exe	92
PID 4496 wrote to memory of 1464	4496	rejoice813.exe	93
PID 4496 wrote to memory of 1464	4496	rejoice813.exe	93
PID 4496 wrote to memory of 1464	4496	rejoice813.exe	93
PID 4496 wrote to memory of 1464	4496	rejoice813.exe	93
PID 4496 wrote to memory of 1464	4496	rejoice813.exe	93
PID 4496 wrote to memory of 3456	4496	rejoice813.exe	98
PID 4496 wrote to memory of 3456	4496	rejoice813.exe	98
PID 4496 wrote to memory of 3456	4496	rejoice813.exe	98
PID 4496 wrote to memory of 3896	4496	rejoice813.exe	99
PID 4496 wrote to memory of 3896	4496	rejoice813.exe	99
PID 4496 wrote to memory of 3896	4496	rejoice813.exe	99
PID 4496 wrote to memory of 4296	4496	rejoice813.exe	104
PID 4496 wrote to memory of 4296	4496	rejoice813.exe	104
PID 4496 wrote to memory of 4296	4496	rejoice813.exe	104
PID 4496 wrote to memory of 4296	4496	rejoice813.exe	104
PID 4496 wrote to memory of 4296	4496	rejoice813.exe	104
PID 4496 wrote to memory of 1368	4496	rejoice813.exe	108
PID 4496 wrote to memory of 1368	4496	rejoice813.exe	108
PID 4496 wrote to memory of 1368	4496	rejoice813.exe	108
PID 4496 wrote to memory of 392	4496	rejoice813.exe	109
PID 4496 wrote to memory of 392	4496	rejoice813.exe	109
PID 4496 wrote to memory of 392	4496	rejoice813.exe	109
PID 4496 wrote to memory of 392	4496	rejoice813.exe	109
PID 4496 wrote to memory of 392	4496	rejoice813.exe	109
PID 4496 wrote to memory of 4476	4496	rejoice813.exe	112
PID 4496 wrote to memory of 4476	4496	rejoice813.exe	112
PID 4496 wrote to memory of 4476	4496	rejoice813.exe	112
PID 4496 wrote to memory of 4580	4496	rejoice813.exe	113
PID 4496 wrote to memory of 4580	4496	rejoice813.exe	113
PID 4496 wrote to memory of 4580	4496	rejoice813.exe	113
PID 4496 wrote to memory of 4580	4496	rejoice813.exe	113
PID 4496 wrote to memory of 4580	4496	rejoice813.exe	113
PID 4496 wrote to memory of 4976	4496	rejoice813.exe	116
PID 4496 wrote to memory of 4976	4496	rejoice813.exe	116
PID 4496 wrote to memory of 4976	4496	rejoice813.exe	116
PID 4496 wrote to memory of 4976	4496	rejoice813.exe	116
PID 4496 wrote to memory of 4976	4496	rejoice813.exe	116
PID 4496 wrote to memory of 4520	4496	rejoice813.exe	119
PID 4496 wrote to memory of 4520	4496	rejoice813.exe	119
PID 4496 wrote to memory of 4520	4496	rejoice813.exe	119
PID 4496 wrote to memory of 4520	4496	rejoice813.exe	119
PID 4496 wrote to memory of 4520	4496	rejoice813.exe	119
PID 4496 wrote to memory of 3056	4496	rejoice813.exe	122
PID 4496 wrote to memory of 3056	4496	rejoice813.exe	122
PID 4496 wrote to memory of 3056	4496	rejoice813.exe	122
PID 4496 wrote to memory of 3056	4496	rejoice813.exe	122
PID 4496 wrote to memory of 3056	4496	rejoice813.exe	122
PID 4496 wrote to memory of 1892	4496	rejoice813.exe	125
PID 4496 wrote to memory of 1892	4496	rejoice813.exe	125
PID 4496 wrote to memory of 1892	4496	rejoice813.exe	125

C:\Users\Admin\AppData\Local\Temp\08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08d2170af43c86ed97d0dac1ff5dda13_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice813.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice813.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    - Suspicious use of UnmapMainImage
    PID:2976
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 12
      4⤵
      Program crash
      PID:1032
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:3136
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:1464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 12
      4⤵
      Program crash
      PID:632
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:3456
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:3896
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:4296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 12
      4⤵
      Program crash
      PID:2256
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:1368
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:392
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 12
      4⤵
      Program crash
      PID:3184
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:4476
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:4580
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 12
      4⤵
      Program crash
      PID:4652
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:4976
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 12
      4⤵
      Program crash
      PID:4984
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:4520
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 12
      4⤵
      Program crash
      PID:3416
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:3056
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 12
      4⤵
      Program crash
      PID:1768
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:1892
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:1084
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 12
      4⤵
      Program crash
      PID:2952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat""
  2⤵
  PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2976 -ip 2976
1⤵
PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1464 -ip 1464
1⤵
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4296 -ip 4296
1⤵
PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 392 -ip 392
1⤵
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4580 -ip 4580
1⤵
PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4976 -ip 4976
1⤵
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4520 -ip 4520
1⤵
PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3056 -ip 3056
1⤵
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1084 -ip 1084
1⤵
PID:2112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Delet.bat

Path C:\Program Files\Common Files\Microsoft Shared\MSINFO\Delet.bat
Size 212B
SHA256 4ee0afb71247d02c06e3ab15ba26e1b3f576149e5ab3b97b8226bda616420e85
MD5 1c26e6dbd374899a7b0bceeeeb790b18
SHA1 10f738dc8709ca4497585c86b6a7d7a02631202a
SHA512 89ee2cdfde82f43bb05675952fde27f49671ef9b3a431541c1e8cfab953466d98d35b5257fc2845e65ef0799befd783c590767fe3b93c76016f68839f6c68bcb
MD5 SHA1 SHA512

Submit Download

rejoice813.exe

Path C:\Program Files\Common Files\microsoft shared\MSInfo\rejoice813.exe
Size 464KB
SHA256 def80d52865a8f5abe1a54989c9869c456f8c2d9722a82dde46f0822ce403977
MD5 08d2170af43c86ed97d0dac1ff5dda13
SHA1 1a392945351dcf710e5ff89bbd84e4ca0042d018
SHA512 1f5920c454955f939d2c8be06282a48342b70fd9c2c5f110ec1fa2c3e94d254192404218a1c0608dd5351c8794155ada85a0b2d964f53448a2b846ebf32fab6a
SSDEEP 6144:VGfbCSJRNESQN53Bf/SWCjNW5uo5McluV67JAI58JLexotC+PrrBO8FL02QFWz/t:gEr93Co5uo2hQKJ20s8F42mSVUDu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4496-10-0x0000000000400000-0x000000000053B000-memory.dmp

Download

memory/4496-13-0x0000000000400000-0x000000000053B000-memory.dmp

Download

memory/4496-22-0x0000000000400000-0x000000000053B000-memory.dmp

Download

memory/4496-25-0x0000000000400000-0x000000000053B000-memory.dmp

Download

memory/4816-0-0x0000000000400000-0x000000000053B000-memory.dmp

Download

memory/4816-1-0x0000000000400000-0x000000000053B000-memory.dmp

Download

memory/4816-2-0x00000000004C7000-0x000000000053A000-memory.dmp

Download

memory/4816-3-0x0000000000400000-0x000000000053B000-memory.dmp

Download

memory/4816-19-0x00000000004C7000-0x000000000053A000-memory.dmp

Download

memory/4816-18-0x0000000000400000-0x000000000053B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads