modiloader | f7f29e51e6602dc2ec0203cbb89483272893eeaac3bde8ff2e2a7d1aced76771

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d314831e0d52f98f915ad07585982623_JaffaCakes118.exe
Size

88KB
MD5

d314831e0d52f98f915ad07585982623
SHA1

7c4cb86281b0f94e03eed862719987565fd76f40
SHA256

f7f29e51e6602dc2ec0203cbb89483272893eeaac3bde8ff2e2a7d1aced76771
SHA512

432055c6cbe54f624edfbed7c1be734b9d2ef1de4a135d8de0474a81ea7e5ef393e17f37276e2d6cce778cb28f382c866cb1f6963b06b1215d797ef10130e504
SSDEEP

768:RI3l51bcgBH5T9Zztj7CzrWBFWGXNtmMX5VqkR6QMcXfYP+:Rimg5Tf9u8kotmMX5VnXfYP+

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/1800-8-0x0000000000400000-0x000000000041D000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
1824	1.exe

Loads dropped DLL 2 IoCs

pid	Process
1800	d314831e0d52f98f915ad07585982623_JaffaCakes118.exe
1800	d314831e0d52f98f915ad07585982623_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d314831e0d52f98f915ad07585982623_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1824	1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1824	1800	d314831e0d52f98f915ad07585982623_JaffaCakes118.exe	30
PID 1800 wrote to memory of 1824	1800	d314831e0d52f98f915ad07585982623_JaffaCakes118.exe	30
PID 1800 wrote to memory of 1824	1800	d314831e0d52f98f915ad07585982623_JaffaCakes118.exe	30
PID 1800 wrote to memory of 1824	1800	d314831e0d52f98f915ad07585982623_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\d314831e0d52f98f915ad07585982623_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d314831e0d52f98f915ad07585982623_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Local\Temp\1.exe
  "C:\Users\Admin\AppData\Local\Temp\1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.exe

Filesize
53KB

MD5
7a577c1514a3b98b00eca1b56f7ccf54

SHA1
889da039124637b0672459533aff03fe49ca489f

SHA256
877de0c009e3a9a7df804d47937903207c3b06298a1fc7012e6496955b5c3962

SHA512
d347dc6ca97b003f51abf3fb089e8cf2567ff9df5979fd48d6bf9dee84d5138a39e5e2a2c8fd6ba43fc69576dfbff6c85e1892f2d8d194dd67da46824f992ab7

Download Submit
memory/1800-8-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1824-11-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/1824-14-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download