modiloader | ecb6bfb9988a2e4aff147d15637fff2c227975c89a92685144e1d366eb1c1458

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
220a7af3b2583aa2d601d6994430537e_JaffaCakes118.exe
Size 293KB
Sample240703-mlme7syape
SHA256 ecb6bfb9988a2e4aff147d15637fff2c227975c89a92685144e1d366eb1c1458
MD5 220a7af3b2583aa2d601d6994430537e
SHA1 9b9162ef19a48d4840e32c5aee025be9b815766a
SHA512 b7f094eb55fd1363b418ec8b4b16d9fc66c632579f950b188eb55c4aedcaa8504442092990101e099177d39785bfec0efbf6286ab92f437702b7d405136a8824
SSDEEP 6144:/VdYzgzJeg/3rnNi0dsQVwuCyvUkve4nUwTC0NPsqcWN:zWgfrnvvjUKEqz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/2520-3-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\netcontrol\Parameters\ServiceDll = "C:\\Windows\\system32\\syst.dll"	220a7af3b2583aa2d601d6994430537e_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syst.dll	220a7af3b2583aa2d601d6994430537e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Deleteme.bat	220a7af3b2583aa2d601d6994430537e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 4036	2520	220a7af3b2583aa2d601d6994430537e_JaffaCakes118.exe	84
PID 2520 wrote to memory of 4036	2520	220a7af3b2583aa2d601d6994430537e_JaffaCakes118.exe	84
PID 2520 wrote to memory of 4036	2520	220a7af3b2583aa2d601d6994430537e_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\220a7af3b2583aa2d601d6994430537e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\220a7af3b2583aa2d601d6994430537e_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
  2⤵
  PID:4036

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netservice
1⤵
PID:920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Deleteme.bat

Path C:\Windows\SysWOW64\Deleteme.bat
Size 212B
SHA256 16b1c8304b72440e60b69698c3231aee3f28212e75236fd394f38a7cf1e38359
MD5 5f6b0d149823212f3d5367c85b5bc16c
SHA1 b04f17a9529dbcd0383767eec4319ae78cf53a42
SHA512 81110d339e4f6f09fa5eec65e97396baa0c910984ac333f54337257bb76b9a697a1129e9048f59a8c5751b8238fb583b78305307e32bfaaf3d48a21bc3dc1bc0
MD5 SHA1 SHA512

Submit Download

memory/2520-3-0x0000000000400000-0x000000000044F000-memory.dmp

Download