modiloader | f12b5aabbb28b4b9ebffd434d490070dcb84018ba0c09b27c5b3f9453d73655d

Analysis

max time kernel
95s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-09-2024 06:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6417d8fa704d4e6a606fdda413db481_JaffaCakes118.exe
Size

280KB
MD5

e6417d8fa704d4e6a606fdda413db481
SHA1

c1595c468563ab33001c70d87c4703c5fdf6b4dc
SHA256

f12b5aabbb28b4b9ebffd434d490070dcb84018ba0c09b27c5b3f9453d73655d
SHA512

db10949ac3bc63e2c457c3df097238d3f0801d1d7c77f871de5503409d45bffaed5277b7e3bc20ce51e45126e91882dd9ec0b119717a7fa4bdab872802216be4
SSDEEP

6144:xs0AA+O4T6WqOjk0B6n21hpGATJ62NYg2Xxc8XPz4raxdvr+CtIO4fK:BBB4Dzkfn21hYATk2v2fX74raxdvHtIX

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/4524-8-0x0000000000400000-0x0000000000506000-memory.dmp	modiloader_stage2

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SetupDel.bat	e6417d8fa704d4e6a606fdda413db481_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\csrss.exe	e6417d8fa704d4e6a606fdda413db481_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\csrss.exe	e6417d8fa704d4e6a606fdda413db481_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e6417d8fa704d4e6a606fdda413db481_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 4084	4524	e6417d8fa704d4e6a606fdda413db481_JaffaCakes118.exe	82
PID 4524 wrote to memory of 4084	4524	e6417d8fa704d4e6a606fdda413db481_JaffaCakes118.exe	82
PID 4524 wrote to memory of 4084	4524	e6417d8fa704d4e6a606fdda413db481_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\e6417d8fa704d4e6a606fdda413db481_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e6417d8fa704d4e6a606fdda413db481_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\SetupDel.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\SetupDel.bat

Filesize
212B

MD5
a2649c9a738dd1aff9d9896b1827efe6

SHA1
cd590e1c4781b709be447bcec2370e845c98c8b2

SHA256
cdea1035741fd19eda09a0bdeb8ddd54d98c428a5b895b684152a91fc67cb744

SHA512
06a66889c4a1c5bd14f3020a69eeb4f18cfdecea25407616f0bdf773b7718f8337b3889b617d16156cd795c7eb9dda0c7d2e27ab2772bb1c739d36dbb51f6beb

Download Submit
memory/4524-0-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/4524-1-0x00000000006D0000-0x00000000006D4000-memory.dmp

Filesize
16KB

Download
memory/4524-2-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/4524-8-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download