modiloader | 6fcf6855872b2da7ae726357454b52c8da4d694124e87f71bb34eac2d7893645

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfc5eb7c41688087dd47d68d6886232a_JaffaCakes118.exe
Size

456KB
MD5

dfc5eb7c41688087dd47d68d6886232a
SHA1

2b24af7823fe3efd9058a7244ea4c2a6d871f527
SHA256

6fcf6855872b2da7ae726357454b52c8da4d694124e87f71bb34eac2d7893645
SHA512

5fc4d7640e493761b6b7535258fa82ac87a5891dd05b188f2c075b9ebcf5064efeb8d4f4f09e5a9ed9fe638a6a01ae215423f7bd4c4e2d639a655ec578f0214a
SSDEEP

12288:Kctw2LaGxhPz63MaFQyfOsbKabiIQPZnj:gyPz63DQyqQS

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/888-3-0x0000000000400000-0x00000000004D6CD0-memory.dmp	modiloader_stage2

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
888	dfc5eb7c41688087dd47d68d6886232a_JaffaCakes118.exe
888	dfc5eb7c41688087dd47d68d6886232a_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4812	888	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfc5eb7c41688087dd47d68d6886232a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\dfc5eb7c41688087dd47d68d6886232a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dfc5eb7c41688087dd47d68d6886232a_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 288
  2⤵
  - Program crash
  PID:4812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 888 -ip 888
1⤵
PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/888-0-0x0000000000400000-0x00000000004D6CD0-memory.dmp

Filesize
859KB

Download
memory/888-2-0x00000000004C0000-0x00000000004D7000-memory.dmp

Filesize
92KB

Download
memory/888-1-0x00000000004C0000-0x00000000004D7000-memory.dmp

Filesize
92KB

Download
memory/888-3-0x0000000000400000-0x00000000004D6CD0-memory.dmp

Filesize
859KB

Download