modiloader | b5e7f5a64b4d9b7f50f593b2511d5ad5758a774c72fbbc52cb9f27ca8d2149e7 | Triage

Submit
Reports

Overview

overview

Static

static

3

614f2172fd...18.exe

windows7-x64

614f2172fd...18.exe

windows10-2004-x64

7

Sharing

General

Target

614f2172fd92972a124717b50e8f5cb9_JaffaCakes118
Size

1.4MB
Sample

240721-zexzkswclp
MD5

614f2172fd92972a124717b50e8f5cb9
SHA1

da24d1914e3b645c0dd0f9080bd2455922968d45
SHA256

b5e7f5a64b4d9b7f50f593b2511d5ad5758a774c72fbbc52cb9f27ca8d2149e7
SHA512

78bb5f5e30a42bb524f2648f205b509eee1cf649080a67c87ce35445f2e5730a8d737e197db7e3b6f26e5f138e0e1eef1eba9f08de6a880a4cf41cab7e3e45a0
SSDEEP

24576:R4L7j7ug1MwWHHYgOjcCZreOGeXdgyJZ3BAdhNDQjTj7yJZ3BAdhNDQjTjr:4ug+woHY/ACZreO7X2ORAdhNDQjT3ORx

Score

10^/10

modiloader evasion persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

614f2172fd92972a124717b50e8f5cb9_JaffaCakes118.exe

Resource

win7-20240705-en

modiloader evasion persistence trojan

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral2

Sample

614f2172fd92972a124717b50e8f5cb9_JaffaCakes118.exe

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  
  614f2172fd92972a124717b50e8f5cb9_JaffaCakes118
- Size
  
  1.4MB
- MD5
  
  614f2172fd92972a124717b50e8f5cb9
- SHA1
  
  da24d1914e3b645c0dd0f9080bd2455922968d45
- SHA256
  
  b5e7f5a64b4d9b7f50f593b2511d5ad5758a774c72fbbc52cb9f27ca8d2149e7
- SHA512
  
  78bb5f5e30a42bb524f2648f205b509eee1cf649080a67c87ce35445f2e5730a8d737e197db7e3b6f26e5f138e0e1eef1eba9f08de6a880a4cf41cab7e3e45a0
- SSDEEP
  
  24576:R4L7j7ug1MwWHHYgOjcCZreOGeXdgyJZ3BAdhNDQjTj7yJZ3BAdhNDQjTjr:4ug+woHY/ACZreO7X2ORAdhNDQjT3ORx
Score

10^/10

modiloader evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- UAC bypass
  evasion trojan
- ModiLoader Second Stage
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderevasionpersistencetrojan

behavioral2

© 2018-2025

Terms | Privacy