modiloader | 1035c80b1f862f789886bd990b135ff1159ea47d4d1c2294bb13c96c3b4cb589

Resubmissions

16/07/2024, 01:18

240716-bpdrpaycmr 10

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe
Size

573KB
MD5

4c38000f1d86dc12206ed4bb30262c9e
SHA1

053a994f4f1b55332d07c114c071eec9dfc01d0c
SHA256

1035c80b1f862f789886bd990b135ff1159ea47d4d1c2294bb13c96c3b4cb589
SHA512

bbd5e4a1ab99abab7c1fd74bae96a955ce061c05d79ba33052561dde631f4d8b3bf5bf713140bc403816314a8b0c1588934a394d1f9a28babb7bf92cfeb027e3
SSDEEP

12288:vy4B8cRfv5+2Lqq1WMtS8GX9sAVyLmg/TvxUPYIR:aXce2LDujELTuYIR

Score

10^/10

modiloader bootkit evasion persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/3008-40-0x0000000010000000-0x00000000100C8000-memory.dmp	modiloader_stage2

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Wine	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3008 set thread context of 2732	3008	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe	30

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2732	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe
2732	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2732	3008	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe	30
PID 3008 wrote to memory of 2732	3008	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe	30
PID 3008 wrote to memory of 2732	3008	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe	30
PID 3008 wrote to memory of 2732	3008	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe	30
PID 3008 wrote to memory of 2732	3008	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe	30
PID 3008 wrote to memory of 2732	3008	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe	30
PID 2732 wrote to memory of 1208	2732	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe	21
PID 2732 wrote to memory of 1208	2732	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe	21
PID 2732 wrote to memory of 1208	2732	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe	21
PID 2732 wrote to memory of 1208	2732	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe	21
PID 2732 wrote to memory of 1208	2732	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe	21
PID 2732 wrote to memory of 1208	2732	4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe"
  2⤵
  - Identifies Wine through registry keys
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Users\Admin\AppData\Local\Temp\4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\4c38000f1d86dc12206ed4bb30262c9e_JaffaCakes118.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-51-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/2732-33-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2732-63-0x0000000000020000-0x0000000000031000-memory.dmp

Filesize
68KB

Download
memory/2732-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2732-36-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2732-39-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2732-42-0x0000000000020000-0x0000000000031000-memory.dmp

Filesize
68KB

Download
memory/2732-46-0x0000000010000000-0x00000000100C8000-memory.dmp

Filesize
800KB

Download
memory/2732-47-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3008-21-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-6-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-32-0x0000000001BF0000-0x0000000001BF1000-memory.dmp

Filesize
4KB

Download
memory/3008-20-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-19-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-18-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-17-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-16-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-15-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-14-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-13-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-12-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-11-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-10-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-9-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-8-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-7-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-22-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-5-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-4-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-3-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-2-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-1-0x0000000000300000-0x0000000000335000-memory.dmp

Filesize
212KB

Download
memory/3008-0-0x0000000010000000-0x00000000100C8000-memory.dmp

Filesize
800KB

Download
memory/3008-23-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-41-0x0000000010001000-0x0000000010005000-memory.dmp

Filesize
16KB

Download
memory/3008-24-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-25-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-26-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-40-0x0000000010000000-0x00000000100C8000-memory.dmp

Filesize
800KB

Download
memory/3008-27-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-28-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-29-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-30-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/3008-31-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download