modiloader | 6e6aef49afd787d07ac598538f2c83e8690a0d7f4a79da6944b2b70e90b1b9eb

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 18:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe
Size 392KB
Sample240703-xhbjmsvbnf
SHA256 6e6aef49afd787d07ac598538f2c83e8690a0d7f4a79da6944b2b70e90b1b9eb
MD5 2365e5ae55ff69806a18f70f0802d8e3
SHA1 19f5493319b988c950482f749901846fdb2f676f
SHA512 50dd7a5991592454f2373daf8d5bbd2ebe2bf1fe2097c8c372771a709c2f512ba44709ad8181bf1a9d9a24bbf28dc9591e36fe606d0711231bece4d7e47cf89e
SSDEEP 6144:1bx1JNRm9uXcUy8yp8imvbkaKNjOG6O65s0mjY5WwAYa7zQ07qKLwkaupcP2BJDY:xJNRmOc6fbkvAGpPLjxzUuiPIsBH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe ZReload.scr"	csrss.exe

ModiLoader Second Stage 9 IoCs

resource	yara_rule
behavioral2/memory/220-0-0x0000000000010000-0x0000000000079000-memory.dmp	modiloader_stage2
behavioral2/files/0x0009000000023454-6.dat	modiloader_stage2
behavioral2/memory/220-13-0x0000000000010000-0x0000000000079000-memory.dmp	modiloader_stage2
behavioral2/memory/3200-14-0x00000000021E0000-0x000000000228A000-memory.dmp	modiloader_stage2
behavioral2/files/0x000700000002345c-18.dat	modiloader_stage2
behavioral2/memory/2524-37-0x0000000000010000-0x0000000000079000-memory.dmp	modiloader_stage2
behavioral2/memory/1848-38-0x0000000000730000-0x00000000007DA000-memory.dmp	modiloader_stage2
behavioral2/memory/3200-27-0x00000000021E0000-0x000000000228A000-memory.dmp	modiloader_stage2
behavioral2/memory/1848-69-0x0000000000730000-0x00000000007DA000-memory.dmp	modiloader_stage2

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\services.exe	csrss.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

pid	Process
2524	csrss.exe
1848	csrss.exe
2536	services.exe

Loads dropped DLL 4 IoCs

pid	Process
220	2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe
220	2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe
2524	csrss.exe
2524	csrss.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rlog.dllx	csrss.exe
File opened for modification	C:\Windows\SysWOW64\ZReload.scr	csrss.exe
File created	C:\Windows\SysWOW64\ZReload.scrx	csrss.exe
File created	C:\Windows\SysWOW64\Zreload.scr	csrss.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 220 set thread context of 3200	220	2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe	83
PID 2524 set thread context of 1848	2524	csrss.exe	90

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\csrss.exe	cmd.exe
File opened for modification	C:\Windows\csrss.exe	cmd.exe
File opened for modification	C:\Windows\csrss.exe	csrss.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2536	services.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 3200	220	2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe	83
PID 220 wrote to memory of 3200	220	2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe	83
PID 220 wrote to memory of 3200	220	2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe	83
PID 220 wrote to memory of 3200	220	2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe	83
PID 220 wrote to memory of 3200	220	2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe	83
PID 3200 wrote to memory of 4920	3200	2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe	84
PID 3200 wrote to memory of 4920	3200	2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe	84
PID 3200 wrote to memory of 4920	3200	2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe	84
PID 3200 wrote to memory of 2524	3200	2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe	89
PID 3200 wrote to memory of 2524	3200	2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe	89
PID 3200 wrote to memory of 2524	3200	2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe	89
PID 2524 wrote to memory of 1848	2524	csrss.exe	90
PID 2524 wrote to memory of 1848	2524	csrss.exe	90
PID 2524 wrote to memory of 1848	2524	csrss.exe	90
PID 2524 wrote to memory of 1848	2524	csrss.exe	90
PID 2524 wrote to memory of 1848	2524	csrss.exe	90
PID 1848 wrote to memory of 2536	1848	csrss.exe	91
PID 1848 wrote to memory of 2536	1848	csrss.exe	91
PID 1848 wrote to memory of 2536	1848	csrss.exe	91

C:\Users\Admin\AppData\Local\Temp\2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:220
- C:\Users\Admin\AppData\Local\Temp\2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy "C:\Users\Admin\AppData\Local\Temp\2365e5ae55ff69806a18f70f0802d8e3_JaffaCakes118.exe" "C:\Windows\csrss.exe"
    3⤵
    - Drops file in Windows directory
    PID:4920
- - C:\Windows\csrss.exe
    "C:\Windows\csrss.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Windows\csrss.exe
      C:\Windows\csrss.exe
      4⤵
      Modifies WinLogon for persistence
      Drops file in Drivers directory
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:1848
    - - C:\Windows\SysWOW64\drivers\services.exe
        
        C:\Windows\system32\drivers\services.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kacir.bin

Path C:\Users\Admin\AppData\Local\Temp\kacir.bin
Size 10KB
SHA256 bd2e3f399610c873da9bc27204024524f481b10a22947193f6558246f05fae15
MD5 ddb56c87d10647289236f9fe752d80cd
SHA1 e698b332a1a05bab72eb9f8f25d7e98314ae0124
SHA512 c97e78ca6562a285270966b4af35e5103b8b9005a9c0b7c741cb58b941ab18ce2a6894c06087c0e7e0adae0a36113609583dbdc99a803dba0c63fbe3a768998c
SSDEEP 192:cqwmt2IlzpzRV6O001lubxgbCe2P5PzLdRotzDQhDt5Q0nFAsFPeHJ8cQ99lit:C+RWqzM5PX1XQzk2H1Q9ut
MD5 SHA1 SHA512 SSDEEP

Submit Download

kacir.dll

Path C:\Users\Admin\AppData\Local\Temp\kacir.dll
Size 19KB
SHA256 e5fa2290f69a152c53dec772142ddb3d4c04cb2ee25ad05b0ec97ab202361f11
MD5 dda37de6068ad16771e3a6464bb8778b
SHA1 903317703bfcd07e9bea7246920de98916017e08
SHA512 1d38ba967b34c6d48b8048bf282484bc6c8d6f3644a127a8102d3edbcf5dd854744da7e8f15b10b93b6124db634a7c891c1c175fca8a7b2e6810fc204132ea05
SSDEEP 384:1RdCy9MqlWTmQ62brtKB4aaJjxo47dm3z092b:9CyaqlGmQJbwB49jxo4Uj0U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Zreload.scr

Path C:\Windows\SysWOW64\Zreload.scr
Size 14KB
SHA256 5b8472a155319b7efb5c1014ac2e496a5d8d1983cf03c01109e5f9fc84856d11
MD5 6abb069dc49bd126d961a5f6a86f6476
SHA1 ed739f57de5865f50e2d45c6ff561a7dac1d9aba
SHA512 eb655772d493654a15a4ac43b5d26d4e17b934e720f0ea434177bf5cb3c4432ce3d0d4e5813b5da7925cedde729305bc4d8cb263ee20e618dc389dbd4bb0a246
SSDEEP 192:no461A/0LiwxqfKD6Vk/gqWhiQ7SV92sGNli3KQjcWQfX0:rx0iwxqsRQmV92tlbAzQfX0
MD5 SHA1 SHA512 SSDEEP

Submit Download

services.exe

Path C:\Windows\SysWOW64\drivers\services.exe
Size 17KB
SHA256 a8da23fe337876557631d6122ae1ea0ab4fb1fd02f2c2b2c18317b53cd0c81b7
MD5 0a1fddec35b3b40756a26c044e22dbe1
SHA1 017d4e673666088307951a7cdc7bce85a351faaf
SHA512 7a3c30fa5cf5ea19774c094c54627a18beb7f21570710808d1c10e43aebcca654c13192617d027a264807fa4171cb2f52204642fd1be841a15d231bf75cf074b
SSDEEP 384:NRdCyFMqlWwmQmiNpeb9YLJ6eQmAzXb0a:lCyyql1mQ9Lge8
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\csrss.exe
Size 392KB
SHA256 6e6aef49afd787d07ac598538f2c83e8690a0d7f4a79da6944b2b70e90b1b9eb
MD5 2365e5ae55ff69806a18f70f0802d8e3
SHA1 19f5493319b988c950482f749901846fdb2f676f
SHA512 50dd7a5991592454f2373daf8d5bbd2ebe2bf1fe2097c8c372771a709c2f512ba44709ad8181bf1a9d9a24bbf28dc9591e36fe606d0711231bece4d7e47cf89e
SSDEEP 6144:1bx1JNRm9uXcUy8yp8imvbkaKNjOG6O65s0mjY5WwAYa7zQ07qKLwkaupcP2BJDY:xJNRmOc6fbkvAGpPLjxzUuiPIsBH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-13-0x0000000000010000-0x0000000000079000-memory.dmp

Download

memory/220-0-0x0000000000010000-0x0000000000079000-memory.dmp

Download

memory/1848-39-0x0000000004840000-0x0000000004841000-memory.dmp

Download

memory/1848-38-0x0000000000730000-0x00000000007DA000-memory.dmp

Download

memory/1848-69-0x0000000000730000-0x00000000007DA000-memory.dmp

Download

memory/1848-76-0x0000000004840000-0x0000000004841000-memory.dmp

Download

memory/2524-37-0x0000000000010000-0x0000000000079000-memory.dmp

Download

memory/2536-61-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3200-15-0x0000000004310000-0x0000000004311000-memory.dmp

Download

memory/3200-14-0x00000000021E0000-0x000000000228A000-memory.dmp

Download

memory/3200-27-0x00000000021E0000-0x000000000228A000-memory.dmp

Download

memory/3200-26-0x00000000005B0000-0x000000000065D000-memory.dmp

Download

memory/3200-10-0x00000000005B0000-0x000000000065D000-memory.dmp

Download

memory/3200-11-0x00000000005B0000-0x000000000065D000-memory.dmp

Download

memory/3200-12-0x00000000005B0000-0x000000000065D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads