modiloader | 62fbeb646293b7d55ec5f9f0d7ed43e1e498510349b46ca93388e8b2bb9dc948

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 19:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe
Size

577KB
MD5

dec6c60c89ba5247d5e783a817a3b8ee
SHA1

4b5bf5972de8298c82254313d3603ca7e57d0c7d
SHA256

62fbeb646293b7d55ec5f9f0d7ed43e1e498510349b46ca93388e8b2bb9dc948
SHA512

6808270489935e44d9fc299bf03075c716dbc7c7af1ee0939baef3c45c6b07aabf84e03906142c9de56154b1995aaeb53e0622c3bec37d0f59ca01835419126f
SSDEEP

12288:LeohY7kszv6ynzRtxvlX3UHZEylVVGYMvtTvxkgoV:LYTvnbcmyLV34rPQ

Score

10^/10

modiloader discovery execution trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	404	mshta.exe	87

ModiLoader Second Stage 12 IoCs

resource	yara_rule
behavioral2/memory/3948-7-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral2/memory/3948-3-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral2/memory/3948-8-0x0000000000400000-0x0000000000439000-memory.dmp	modiloader_stage2
behavioral2/memory/3948-55-0x0000000000FB0000-0x0000000001084000-memory.dmp	modiloader_stage2
behavioral2/memory/3948-62-0x0000000000FB0000-0x0000000001084000-memory.dmp	modiloader_stage2
behavioral2/memory/3948-64-0x0000000000FB0000-0x0000000001084000-memory.dmp	modiloader_stage2
behavioral2/memory/3948-63-0x0000000000FB0000-0x0000000001084000-memory.dmp	modiloader_stage2
behavioral2/memory/3948-61-0x0000000000FB0000-0x0000000001084000-memory.dmp	modiloader_stage2
behavioral2/memory/3948-71-0x0000000000FB0000-0x0000000001084000-memory.dmp	modiloader_stage2
behavioral2/memory/3948-59-0x0000000000FB0000-0x0000000001084000-memory.dmp	modiloader_stage2
behavioral2/memory/3948-72-0x0000000000FB0000-0x0000000001084000-memory.dmp	modiloader_stage2
behavioral2/memory/3948-93-0x0000000000FB0000-0x0000000001084000-memory.dmp	modiloader_stage2

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000800000002344e-17.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	mshta.exe

Loads dropped DLL 1 IoCs

pid	Process
3948	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000800000002344e-17.dat	upx
behavioral2/memory/3948-68-0x0000000072BA0000-0x0000000072BCE000-memory.dmp	upx
behavioral2/memory/3948-94-0x0000000072BA0000-0x0000000072BCE000-memory.dmp	upx
behavioral2/memory/3948-103-0x0000000072BA0000-0x0000000072BCE000-memory.dmp	upx
behavioral2/memory/3948-110-0x0000000072BA0000-0x0000000072BCE000-memory.dmp	upx

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
556	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2620 set thread context of 3948	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe
556	powershell.exe
556	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe
Token: SeDebugPrivilege	556	powershell.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 3948	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	86
PID 2620 wrote to memory of 3948	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	86
PID 2620 wrote to memory of 3948	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	86
PID 2620 wrote to memory of 3948	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	86
PID 2620 wrote to memory of 3948	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	86
PID 2620 wrote to memory of 3948	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	86
PID 2620 wrote to memory of 3948	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	86
PID 2620 wrote to memory of 3948	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	86
PID 2620 wrote to memory of 3948	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	86
PID 2620 wrote to memory of 2672	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	44
PID 2620 wrote to memory of 2164	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	38
PID 2620 wrote to memory of 2556	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	42
PID 2620 wrote to memory of 4384	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	64
PID 2620 wrote to memory of 1960	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	33
PID 2620 wrote to memory of 776	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	9
PID 2620 wrote to memory of 1364	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	22
PID 2620 wrote to memory of 772	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	8
PID 2620 wrote to memory of 1556	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	26
PID 2620 wrote to memory of 3708	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	71
PID 2620 wrote to memory of 3904	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	81
PID 2620 wrote to memory of 948	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	12
PID 2620 wrote to memory of 2636	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	69
PID 2620 wrote to memory of 1680	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	29
PID 2620 wrote to memory of 1732	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	30
PID 2620 wrote to memory of 2828	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	47
PID 2620 wrote to memory of 4868	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	74
PID 2620 wrote to memory of 1796	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	84
PID 2620 wrote to memory of 1320	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	21
PID 2620 wrote to memory of 3288	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	56
PID 2620 wrote to memory of 2696	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	45
PID 2620 wrote to memory of 3680	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	57
PID 2620 wrote to memory of 3948	2620	dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe	86
PID 1044 wrote to memory of 556	1044	mshta.exe	89
PID 1044 wrote to memory of 556	1044	mshta.exe	89
PID 1044 wrote to memory of 556	1044	mshta.exe	89

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:772

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1556
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2556

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1960

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2164

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2828

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3680

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2636

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:3708

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4868

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3904

C:\Users\Admin\AppData\Local\Temp\dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Users\Admin\AppData\Local\Temp\dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\dec6c60c89ba5247d5e783a817a3b8ee_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3948

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1796

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" javascript:pyQc58zqy="jJHN7w6Uy";xo4=new%20ActiveXObject("WScript.Shell");i33UGphyW="QKWB";w1CBw=xo4.RegRead("HKLM\\software\\Wow6432Node\\zTENiEYKZ\\GiLSnPo");W1ertFZ="okFb";eval(w1CBw);gkCZc2Uf="9tJj";
1⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:izugxfgp
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\432fggqdd.txt

Filesize
4B

MD5
6df182582740607da754e4515b70e32d

SHA1
1e8d0db4d285c13611cf3affd3dc3119d6569574

SHA256
24a47a476d5cbb0d00f5c33a6820e22ed99c1308b1e9679c0407148b4e93dcdb

SHA512
9d103065dab5dabb5addc996d73f26ac2e05f102a37dd56cdda0351e690e68e9cca80bd4ef7598927d2207743db271eea9697945951ba221febdb802baa44034

Download Submit
C:\Users\Admin\AppData\Local\Temp\4fggqdd.txt

Filesize
84B

MD5
7620ce4107508bfa4c6ee595b7ab6b1d

SHA1
1e383fe1fec18eec4481be7e6ea3d56288a36f01

SHA256
e4e86e98f3d50520f98ddd6d91e8425e6091ea15d7d1820967d5ccca50ff5daa

SHA512
0108da7c156716618e361d07d0e0a295862005101a4b7ddda9190d6749df611c08cf7c6c0ad052f1bc85512a82f289a8bbf15eb6517a622afcc3004d9e3461d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fbyty2s0.swg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8754.tmp

Filesize
66KB

MD5
aaa698721f488b181bc0f0afc5da126a

SHA1
76536a73f16ffd643ea24f8725cebfff9d49852f

SHA256
e71ba7ce01d10e60a4feac7fc5e04f34756ba621c7d88583d0f96bd3b2655647

SHA512
67d8b05678fbdc1678515c341fa8c1e26f3d1b15f2cc390bb9b1a26589a346fd57697dd3366e72d46ab265570929f1be89b8aec81112a2a98194c5886c89261d

Download Submit
memory/556-91-0x0000000007B30000-0x00000000081AA000-memory.dmp

Filesize
6.5MB

Download
memory/556-77-0x0000000005D30000-0x0000000005D96000-memory.dmp

Filesize
408KB

Download
memory/556-74-0x0000000004F00000-0x0000000004F36000-memory.dmp

Filesize
216KB

Download
memory/556-89-0x00000000062E0000-0x00000000062FE000-memory.dmp

Filesize
120KB

Download
memory/556-75-0x0000000005590000-0x0000000005BB8000-memory.dmp

Filesize
6.2MB

Download
memory/556-88-0x0000000005E10000-0x0000000006164000-memory.dmp

Filesize
3.3MB

Download
memory/556-92-0x00000000067E0000-0x00000000067FA000-memory.dmp

Filesize
104KB

Download
memory/556-90-0x0000000006370000-0x00000000063BC000-memory.dmp

Filesize
304KB

Download
memory/556-76-0x0000000005530000-0x0000000005552000-memory.dmp

Filesize
136KB

Download
memory/556-78-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Filesize
408KB

Download
memory/2620-2-0x0000000075350000-0x0000000075901000-memory.dmp

Filesize
5.7MB

Download
memory/2620-70-0x0000000075350000-0x0000000075901000-memory.dmp

Filesize
5.7MB

Download
memory/2620-1-0x0000000075350000-0x0000000075901000-memory.dmp

Filesize
5.7MB

Download
memory/2620-0-0x0000000075352000-0x0000000075353000-memory.dmp

Filesize
4KB

Download
memory/3948-62-0x0000000000FB0000-0x0000000001084000-memory.dmp

Filesize
848KB

Download
memory/3948-72-0x0000000000FB0000-0x0000000001084000-memory.dmp

Filesize
848KB

Download
memory/3948-59-0x0000000000FB0000-0x0000000001084000-memory.dmp

Filesize
848KB

Download
memory/3948-71-0x0000000000FB0000-0x0000000001084000-memory.dmp

Filesize
848KB

Download
memory/3948-61-0x0000000000FB0000-0x0000000001084000-memory.dmp

Filesize
848KB

Download
memory/3948-63-0x0000000000FB0000-0x0000000001084000-memory.dmp

Filesize
848KB

Download
memory/3948-68-0x0000000072BA0000-0x0000000072BCE000-memory.dmp

Filesize
184KB

Download
memory/3948-64-0x0000000000FB0000-0x0000000001084000-memory.dmp

Filesize
848KB

Download
memory/3948-55-0x0000000000FB0000-0x0000000001084000-memory.dmp

Filesize
848KB

Download
memory/3948-8-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3948-3-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3948-7-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3948-93-0x0000000000FB0000-0x0000000001084000-memory.dmp

Filesize
848KB

Download
memory/3948-94-0x0000000072BA0000-0x0000000072BCE000-memory.dmp

Filesize
184KB

Download
memory/3948-103-0x0000000072BA0000-0x0000000072BCE000-memory.dmp

Filesize
184KB

Download
memory/3948-110-0x0000000072BA0000-0x0000000072BCE000-memory.dmp

Filesize
184KB

Download