modiloader | 21fa97a362bc9e3834b83caffde41688f84bd332a6e95eeaedb3bbd6cbacc55b

Analysis

max time kernel
135s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14973a4e00c34132863ecf65897efaf1_JaffaCakes118.exe
Size 375KB
Sample240627-eg4vpatfpk
SHA256 21fa97a362bc9e3834b83caffde41688f84bd332a6e95eeaedb3bbd6cbacc55b
MD5 14973a4e00c34132863ecf65897efaf1
SHA1 74a1efbc2bf234532861ea473aaa74066936e6aa
SHA512 70e7efdf83b8630a08f40ba0236ab90c4fae0ff9bf062d1e7cc478a3c92931776245ae6783ecc63190e8d4d4463034bbd577528338ad4349940327651a2b22d0
SSDEEP 6144:bggxHADZ6shkkogkGyn0oapyV8O09MwETEXExJss0pZz2ImzSsbonmP0mwqndpOf:UgxHADZzncHawL09MyeKs0pxUGjwZwqY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 5 IoCs

resource	yara_rule
behavioral2/files/0x000900000002349e-4.dat	modiloader_stage2
behavioral2/memory/3720-8-0x0000000000F60000-0x0000000001018000-memory.dmp	modiloader_stage2
behavioral2/memory/4928-9-0x0000000000400000-0x00000000004B7200-memory.dmp	modiloader_stage2
behavioral2/memory/3004-14-0x0000000000CF0000-0x0000000000DA8000-memory.dmp	modiloader_stage2
behavioral2/memory/4296-15-0x0000000000400000-0x00000000004B7200-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

pid	Process
4928	4.exe
4296	4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	14973a4e00c34132863ecf65897efaf1_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FieleWay.txt	4.exe
File opened for modification	C:\Windows\SysWOW64\FieleWay.txt	4.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4928 set thread context of 3720	4928	4.exe	88
PID 4296 set thread context of 3004	4296	4.exe	90

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1F652440-3439-11EF-B1BA-424A43B6706F} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4092596647"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4095565077"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4092596647"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115333"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115333"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426225516"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115333"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3720	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3720	IEXPLORE.EXE
3720	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 4928	3164	14973a4e00c34132863ecf65897efaf1_JaffaCakes118.exe	87
PID 3164 wrote to memory of 4928	3164	14973a4e00c34132863ecf65897efaf1_JaffaCakes118.exe	87
PID 3164 wrote to memory of 4928	3164	14973a4e00c34132863ecf65897efaf1_JaffaCakes118.exe	87
PID 4928 wrote to memory of 3720	4928	4.exe	88
PID 4928 wrote to memory of 3720	4928	4.exe	88
PID 4928 wrote to memory of 3720	4928	4.exe	88
PID 3164 wrote to memory of 4296	3164	14973a4e00c34132863ecf65897efaf1_JaffaCakes118.exe	89
PID 3164 wrote to memory of 4296	3164	14973a4e00c34132863ecf65897efaf1_JaffaCakes118.exe	89
PID 3164 wrote to memory of 4296	3164	14973a4e00c34132863ecf65897efaf1_JaffaCakes118.exe	89
PID 4296 wrote to memory of 3004	4296	4.exe	90
PID 4296 wrote to memory of 3004	4296	4.exe	90
PID 4296 wrote to memory of 3004	4296	4.exe	90
PID 3720 wrote to memory of 2404	3720	IEXPLORE.EXE	91
PID 3720 wrote to memory of 2404	3720	IEXPLORE.EXE	91
PID 3720 wrote to memory of 2404	3720	IEXPLORE.EXE	91

C:\Users\Admin\AppData\Local\Temp\14973a4e00c34132863ecf65897efaf1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14973a4e00c34132863ecf65897efaf1_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3720
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3720 CREDAT:17410 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2404
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    - Modifies Internet Explorer settings
    PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 471B
SHA256 28766e681bf500e9cddbcd3275cd898c4165354ad087c2461d9ee374a7e2221e
MD5 5f0847e5a15af2d7923393c3cd30c5d1
SHA1 326c44f2bc29ec6578a400d6d46361efcb013540
SHA512 a83751183cd1f2ac063a0077f8edfaecda72a4649437070c83f88151c822ff42d43fb8a291c123af2598e10d15cbdc147cef353b2149baca9462fb02e3d67a06
MD5 SHA1 SHA512

Submit Download

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 404B
SHA256 6aae75eb24d087fd1f1091a4932ba0b3faf696929908fb9bfd98a714aa26e288
MD5 1c1d7a68829b9ca13efd86edfc2c2b55
SHA1 7f98991dbd1a62833d5ff9367faec0204f086b31
SHA512 07c6ccb570142c71b4222b48c92be87ee80d8f32155c5af0adcc3e513e9af3dbfd8de2605e80101b7d28c46698e5cde5803a340ec2f330c58978697a805853d5
MD5 SHA1 SHA512

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

4.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
Size 706KB
SHA256 a832687f05df4c4784002981b2864bf51eddeaf9c711966cefa78ff3ac26cfa2
MD5 f133879c3d304b59b0eca2202097fa78
SHA1 1b977a549ffdc6238b69643e4a16c8f457715fc1
SHA512 e3a8a01f33b466a00def4a9fffc6b64cb05b21079088deac283404dee029bb60b5b38e4a4686f46dc533f46e555246cfd144b06d940014f43f55572512b88999
SSDEEP 12288:aAoSqLh2LuKnlxXaQWfRYNdOXeegJIy8r5K/AyCesT7BksVKu:ax7GuSj9BNcV8/bA0sT7Blgu
MD5 SHA1 SHA512 SSDEEP

Submit Download

FieleWay.txt

Path C:\Windows\SysWOW64\FieleWay.txt
Size 52B
SHA256 82cae14a554a9bca7ae814e8e0e303a90f9feaf1f00d54c9b791163484e61464
MD5 f2d7b9cfb1d27a46856f55570efba5ee
SHA1 b6878495dc20296df54fce2ef62e73b09995067d
SHA512 ee4e6d9ddfb221d7ac4180524648365080cf0526b31ac3ce0fc3d1dd2e1efea55778e43c25783fd838c0c3c4ea2ab539844ae12c93e645e50682881053b1df8e
MD5 SHA1 SHA512

Submit Download

memory/3004-14-0x0000000000CF0000-0x0000000000DA8000-memory.dmp

Download

memory/3164-16-0x0000000001000000-0x00000000010C0000-memory.dmp

Download

memory/3164-0-0x0000000001000000-0x00000000010C0000-memory.dmp

Download

memory/3720-8-0x0000000000F60000-0x0000000001018000-memory.dmp

Download

memory/4296-11-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4296-15-0x0000000000400000-0x00000000004B7200-memory.dmp

Download

memory/4928-9-0x0000000000400000-0x00000000004B7200-memory.dmp

Download

memory/4928-6-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads