modiloader | f7f29e51e6602dc2ec0203cbb89483272893eeaac3bde8ff2e2a7d1aced76771

Analysis

max time kernel
90s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d314831e0d52f98f915ad07585982623_JaffaCakes118.exe
Size

88KB
MD5

d314831e0d52f98f915ad07585982623
SHA1

7c4cb86281b0f94e03eed862719987565fd76f40
SHA256

f7f29e51e6602dc2ec0203cbb89483272893eeaac3bde8ff2e2a7d1aced76771
SHA512

432055c6cbe54f624edfbed7c1be734b9d2ef1de4a135d8de0474a81ea7e5ef393e17f37276e2d6cce778cb28f382c866cb1f6963b06b1215d797ef10130e504
SSDEEP

768:RI3l51bcgBH5T9Zztj7CzrWBFWGXNtmMX5VqkR6QMcXfYP+:Rimg5Tf9u8kotmMX5VnXfYP+

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/1328-10-0x0000000000400000-0x000000000041D000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	d314831e0d52f98f915ad07585982623_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3152	1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d314831e0d52f98f915ad07585982623_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3152	1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 3152	1328	d314831e0d52f98f915ad07585982623_JaffaCakes118.exe	86
PID 1328 wrote to memory of 3152	1328	d314831e0d52f98f915ad07585982623_JaffaCakes118.exe	86
PID 1328 wrote to memory of 3152	1328	d314831e0d52f98f915ad07585982623_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\d314831e0d52f98f915ad07585982623_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d314831e0d52f98f915ad07585982623_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Users\Admin\AppData\Local\Temp\1.exe
  "C:\Users\Admin\AppData\Local\Temp\1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.exe

Filesize
53KB

MD5
7a577c1514a3b98b00eca1b56f7ccf54

SHA1
889da039124637b0672459533aff03fe49ca489f

SHA256
877de0c009e3a9a7df804d47937903207c3b06298a1fc7012e6496955b5c3962

SHA512
d347dc6ca97b003f51abf3fb089e8cf2567ff9df5979fd48d6bf9dee84d5138a39e5e2a2c8fd6ba43fc69576dfbff6c85e1892f2d8d194dd67da46824f992ab7

Download Submit
memory/1328-10-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3152-12-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/3152-15-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download