modiloader | b11fd690e228b92788c67c93fcebae7cb2fea527541da43bcf36a5f092ee819c

Analysis

max time kernel
13s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9655b945294da9c7c72bb15797065ee8_JaffaCakes118.exe
Size

285KB
MD5

9655b945294da9c7c72bb15797065ee8
SHA1

18d3055b93800ce4f5849c4c815f848bdbbabb27
SHA256

b11fd690e228b92788c67c93fcebae7cb2fea527541da43bcf36a5f092ee819c
SHA512

76bd85b2dcbcb7d580a8a135d41d831975e09cef864fc658dd0eea79e9aa2f17bc8346c0fab29ae162901f364e86a011218f3dd732c0e46d8c38737f948860b4
SSDEEP

6144:20qa6r5jA47p2Nu/T8HirYSHfMSyFDZhZxLAtsWLzwl:lqa632rHFkd0Zh7AHu

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/memory/2352-2-0x0000000000400000-0x0000000000597000-memory.dmp	modiloader_stage2
behavioral1/memory/2352-5-0x0000000000400000-0x0000000000597000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt	9655b945294da9c7c72bb15797065ee8_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9655b945294da9c7c72bb15797065ee8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2300	2352	9655b945294da9c7c72bb15797065ee8_JaffaCakes118.exe	29
PID 2352 wrote to memory of 2300	2352	9655b945294da9c7c72bb15797065ee8_JaffaCakes118.exe	29
PID 2352 wrote to memory of 2300	2352	9655b945294da9c7c72bb15797065ee8_JaffaCakes118.exe	29
PID 2352 wrote to memory of 2300	2352	9655b945294da9c7c72bb15797065ee8_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\9655b945294da9c7c72bb15797065ee8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9655b945294da9c7c72bb15797065ee8_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2352-0-0x0000000000400000-0x0000000000597000-memory.dmp

Filesize
1.6MB

Download
memory/2352-1-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2352-4-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2352-2-0x0000000000400000-0x0000000000597000-memory.dmp

Filesize
1.6MB

Download
memory/2352-5-0x0000000000400000-0x0000000000597000-memory.dmp

Filesize
1.6MB

Download