modiloader | ddcefa993731e0d4b239ee2f6574efa36a96b076476c4d7cc1cb486b549d2869

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 12:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3906394f2775a94bd3ca9df30ae224ef_JaffaCakes118.exe
Size

628KB
MD5

3906394f2775a94bd3ca9df30ae224ef
SHA1

37d922c208d078e8ebe73e20aaf7f35230b6d9e5
SHA256

ddcefa993731e0d4b239ee2f6574efa36a96b076476c4d7cc1cb486b549d2869
SHA512

4611c2ca0eefbfa85ece5bb8c875b8f1085d1da5751432828891b3f6ee0f312d89937bb82c98f5da9e5ba6e30a0aa83fb551bf8ba93d1e0e64080593259964dc
SSDEEP

12288:06WoqofTTKgGxkrUKqD59+RUXQ/wZyGKXq/jvl8Sx55DiaWkhzgj:Eor+5xkrz1RcoU/7WfgS

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2156-5-0x0000000000400000-0x00000000004A4000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
2844	RRR.exe

Loads dropped DLL 1 IoCs

pid	Process
2156	3906394f2775a94bd3ca9df30ae224ef_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2844	RRR.exe
Token: 33	2844	RRR.exe
Token: SeIncBasePriorityPrivilege	2844	RRR.exe
Token: 33	2844	RRR.exe
Token: SeIncBasePriorityPrivilege	2844	RRR.exe
Token: 33	2844	RRR.exe
Token: SeIncBasePriorityPrivilege	2844	RRR.exe
Token: 33	2844	RRR.exe
Token: SeIncBasePriorityPrivilege	2844	RRR.exe
Token: 33	2844	RRR.exe
Token: SeIncBasePriorityPrivilege	2844	RRR.exe
Token: 33	2844	RRR.exe
Token: SeIncBasePriorityPrivilege	2844	RRR.exe
Token: 33	2844	RRR.exe
Token: SeIncBasePriorityPrivilege	2844	RRR.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2844	2156	3906394f2775a94bd3ca9df30ae224ef_JaffaCakes118.exe	30
PID 2156 wrote to memory of 2844	2156	3906394f2775a94bd3ca9df30ae224ef_JaffaCakes118.exe	30
PID 2156 wrote to memory of 2844	2156	3906394f2775a94bd3ca9df30ae224ef_JaffaCakes118.exe	30
PID 2156 wrote to memory of 2844	2156	3906394f2775a94bd3ca9df30ae224ef_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3906394f2775a94bd3ca9df30ae224ef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3906394f2775a94bd3ca9df30ae224ef_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\RRR.exe
  "C:\Users\Admin\AppData\Local\Temp\RRR.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\RRR.exe

Filesize
606KB

MD5
a15106ddcc36265cc59caeee17f4dc5d

SHA1
2fd0c0c121a8fd6938c9567b31e8f1c331c5b752

SHA256
f328dd36eb662249982e8d1d97f4b21fa7080206392a0d51e397f687e0a743dc

SHA512
887aa5b019d1e709e03388d7a3fca42e5560ebd895dcd97569b505132d402529cc36733d2c9afc3215546a9a59c9e016dcb2be90f18d320d5d2d22ec7d833650

Download Submit
memory/2156-5-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/2844-8-0x00000000741D1000-0x00000000741D2000-memory.dmp

Filesize
4KB

Download
memory/2844-9-0x00000000741D0000-0x000000007477B000-memory.dmp

Filesize
5.7MB

Download
memory/2844-10-0x00000000741D0000-0x000000007477B000-memory.dmp

Filesize
5.7MB

Download
memory/2844-11-0x00000000741D0000-0x000000007477B000-memory.dmp

Filesize
5.7MB

Download
memory/2844-12-0x00000000741D0000-0x000000007477B000-memory.dmp

Filesize
5.7MB

Download