modiloader | dc40ab34a74b027dd88b46eed0a43aecdc8d5e6ba65da291cc4e233ed29a7920

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-09-2024 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe
Size

1.3MB
MD5

e5a20c12cde4cf74036482dc9e979f11
SHA1

6a3d86e2bb27849d97cad17cb8e32ced3391a3eb
SHA256

dc40ab34a74b027dd88b46eed0a43aecdc8d5e6ba65da291cc4e233ed29a7920
SHA512

12476daa6492dd30b45828d5cd259c4493a0ee42451def64a5d1db28f4858941b74a78479d6290b36cfb8eeaeadab1e77c2f731faa11b95e9f432140e19a2be7
SSDEEP

24576:0wQAz+8160S36egiMymL8LXk4ZbvMiftEbj8dmz5xBnqEPcjh/Py:0lAF60uYipmL8FBt126Ic9/K

Score

10^/10

modiloader discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe\""	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe\"C:\\Users\\Admin\\AppData\\Local\\Temp\\e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe\","	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe

ModiLoader Second Stage 6 IoCs

resource	yara_rule
behavioral1/memory/932-4-0x0000000000400000-0x00000000004AD000-memory.dmp	modiloader_stage2
behavioral1/memory/932-7-0x0000000000400000-0x00000000004AD000-memory.dmp	modiloader_stage2
behavioral1/memory/932-6-0x0000000000400000-0x00000000004AD000-memory.dmp	modiloader_stage2
behavioral1/memory/932-5-0x0000000000400000-0x00000000004AD000-memory.dmp	modiloader_stage2
behavioral1/memory/932-9-0x0000000000400000-0x00000000004AD000-memory.dmp	modiloader_stage2
behavioral1/memory/932-29-0x0000000000400000-0x00000000004AD000-memory.dmp	modiloader_stage2

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\server = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe"	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05I41M56-QW07-U20F-YX8T-VB4U6TP4UX63}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe\""	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05I41M56-QW07-U20F-YX8T-VB4U6TP4UX63}	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2296	CODERZ-INC ROOM BOOTER V3 CODERZ-INC.EXE

Loads dropped DLL 2 IoCs

pid	Process
932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe
932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\CODERZ-INC ROOM BOOTER V3 CODERZ-INC.EXE	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 948 set thread context of 932	948	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	31

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CODERZ-INC ROOM BOOTER V3 CODERZ-INC.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
948	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe
948	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe
2296	CODERZ-INC ROOM BOOTER V3 CODERZ-INC.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 932	948	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	31
PID 948 wrote to memory of 932	948	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	31
PID 948 wrote to memory of 932	948	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	31
PID 948 wrote to memory of 932	948	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	31
PID 948 wrote to memory of 932	948	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	31
PID 948 wrote to memory of 932	948	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	31
PID 948 wrote to memory of 932	948	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	31
PID 948 wrote to memory of 932	948	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	31
PID 948 wrote to memory of 932	948	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	31
PID 948 wrote to memory of 932	948	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	31
PID 948 wrote to memory of 932	948	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	31
PID 948 wrote to memory of 932	948	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	31
PID 948 wrote to memory of 932	948	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	31
PID 948 wrote to memory of 932	948	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	31
PID 948 wrote to memory of 932	948	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	31
PID 932 wrote to memory of 2296	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	32
PID 932 wrote to memory of 2296	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	32
PID 932 wrote to memory of 2296	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	32
PID 932 wrote to memory of 2296	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	32
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33
PID 932 wrote to memory of 2700	932	e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948
- C:\Users\Admin\AppData\Local\Temp\e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e5a20c12cde4cf74036482dc9e979f11_JaffaCakes118.exe
  2⤵
  - Modifies WinLogon for persistence
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\CODERZ-INC ROOM BOOTER V3 CODERZ-INC.EXE
    "C:\Windows\system32\CODERZ-INC ROOM BOOTER V3 CODERZ-INC.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2296
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\CODERZ-INC ROOM BOOTER V3 CODERZ-INC.EXE

Filesize
480KB

MD5
e188bde7a2760da288d1a842649ce53b

SHA1
5f3986a75523dba3e757efbc0ec55dc4fa237501

SHA256
ec040ba14cbee5caca89d4a2a0f480ddbcb8bdf7e08aa621319224f4781976bc

SHA512
3e192ff6bcd07f6a6a1c3c3bec732d9f7758ff33aedda30e1f794ae59ed57d4270e8a7e5e0345accb4ad1061296f6549c4f8c781d1a460eb5da3b51ce6b8cc80

Download Submit
memory/932-4-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/932-7-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/932-6-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/932-5-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/932-9-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/932-19-0x0000000010410000-0x0000000010449000-memory.dmp

Filesize
228KB

Download
memory/932-29-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/948-0-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download
memory/948-8-0x0000000000400000-0x00000000007AD000-memory.dmp

Filesize
3.7MB

Download