modiloader | 41d8096a6e3bc2ed104f7552a74e9f48795b847d6617b3bfe15a4e1bd1334cc3

Analysis

max time kernel
137s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4809ae66c66459e03019ca5c37be19f_JaffaCakes118.exe
Size

268KB
MD5

b4809ae66c66459e03019ca5c37be19f
SHA1

d7b20cd9569cb747f489468f09557bd24d28406f
SHA256

41d8096a6e3bc2ed104f7552a74e9f48795b847d6617b3bfe15a4e1bd1334cc3
SHA512

84b65d47d6b97c0a2ddf2b9a7f6e89b1306134ee79edbc92523f6df13f2ff1b97b9e4b711f1369ca946699ce777be765c7d1c153cff9fef88ec618859e1e03be
SSDEEP

6144:F1jtZ8mk/mJ8lwQqGZwvOIn/7TFvnh11i:F1jtdkg8lwQqGYx7TF/xi

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/3708-11-0x0000000000400000-0x0000000000443000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	b4809ae66c66459e03019ca5c37be19f_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1244	D.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4809ae66c66459e03019ca5c37be19f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1244	D.exe
1244	D.exe
1244	D.exe
1244	D.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 1244	3708	b4809ae66c66459e03019ca5c37be19f_JaffaCakes118.exe	86
PID 3708 wrote to memory of 1244	3708	b4809ae66c66459e03019ca5c37be19f_JaffaCakes118.exe	86
PID 3708 wrote to memory of 1244	3708	b4809ae66c66459e03019ca5c37be19f_JaffaCakes118.exe	86
PID 1244 wrote to memory of 3452	1244	D.exe	56
PID 1244 wrote to memory of 3452	1244	D.exe	56
PID 1244 wrote to memory of 3452	1244	D.exe	56
PID 1244 wrote to memory of 3452	1244	D.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3452
- C:\Users\Admin\AppData\Local\Temp\b4809ae66c66459e03019ca5c37be19f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b4809ae66c66459e03019ca5c37be19f_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Users\Admin\AppData\Local\Temp\D.exe
    "C:\Users\Admin\AppData\Local\Temp\D.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\D.exe

Filesize
59KB

MD5
6d0c625aa2a08edf593ee6de6d56ef58

SHA1
d296a6de411cf1d84fafe0476022cbf34db3be2a

SHA256
ba8afb16b12cb12b404f6ad9a592f69b8721f1eeb9e07f1dbf5468122acd82a8

SHA512
d62a4ac243396166bd1c19d2f0803b641418e0cc3c7e3d31af658744b06eed3c349334723eb6a27779a593153b1aa1c4e64621930ce0235523bdae9c9d016aa9

Download Submit
memory/1244-8-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1244-10-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/1244-12-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1244-18-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1244-19-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3452-14-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3452-15-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3708-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3708-11-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download