modiloader | 2f90e52b1eef556c894413492812580230a1a672b3abc7b60d10c1b76590c70a

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 02:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8236f96ab727e27ef90be4520ca7af8_JaffaCakes118.exe
Size

21KB
MD5

e8236f96ab727e27ef90be4520ca7af8
SHA1

c59b32bf83d4ffca440a630503e49f44888c6358
SHA256

2f90e52b1eef556c894413492812580230a1a672b3abc7b60d10c1b76590c70a
SHA512

9823a218b4cf73ec223d583e276fc86d06ca32a1382c7a860d19aea6a80c9c3cfc8d58a60d372794f5d3139dabd2c48f440b332cfcc0c05cabe3a000d90f42aa
SSDEEP

384:E2F3dFCD29HoKi5bN0eL5Dx6FQ5M2KesJT1Whv2Sl60b1PX6CElvp:RPCD6Xi5x0Q5Q+LKespZ811Pip

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/memory/1976-18-0x0000000000400000-0x0000000000423000-memory.dmp	modiloader_stage2
behavioral1/memory/2764-20-0x0000000000400000-0x0000000000423000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
2764	sourro.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\qiji.dll	e8236f96ab727e27ef90be4520ca7af8_JaffaCakes118.exe
File created	C:\Windows\sourro.exe	e8236f96ab727e27ef90be4520ca7af8_JaffaCakes118.exe
File opened for modification	C:\Windows\sourro.exe	e8236f96ab727e27ef90be4520ca7af8_JaffaCakes118.exe
File created	C:\Windows\qiji.dll	sourro.exe
File created	C:\Windows\sourro.exe	sourro.exe
File created	C:\Windows\mm	e8236f96ab727e27ef90be4520ca7af8_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8236f96ab727e27ef90be4520ca7af8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sourro.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	1976	e8236f96ab727e27ef90be4520ca7af8_JaffaCakes118.exe
Token: SeRestorePrivilege	1976	e8236f96ab727e27ef90be4520ca7af8_JaffaCakes118.exe
Token: SeBackupPrivilege	1976	e8236f96ab727e27ef90be4520ca7af8_JaffaCakes118.exe
Token: SeRestorePrivilege	1976	e8236f96ab727e27ef90be4520ca7af8_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2764	sourro.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2764	1976	e8236f96ab727e27ef90be4520ca7af8_JaffaCakes118.exe	30
PID 1976 wrote to memory of 2764	1976	e8236f96ab727e27ef90be4520ca7af8_JaffaCakes118.exe	30
PID 1976 wrote to memory of 2764	1976	e8236f96ab727e27ef90be4520ca7af8_JaffaCakes118.exe	30
PID 1976 wrote to memory of 2764	1976	e8236f96ab727e27ef90be4520ca7af8_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\e8236f96ab727e27ef90be4520ca7af8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e8236f96ab727e27ef90be4520ca7af8_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\sourro.exe
  C:\Windows\sourro.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\qiji.dll

Filesize
28KB

MD5
382558503cde1c0e131a55ca89f01fa1

SHA1
e4c0b021ca84252edb18704acf982cd8e556bfd7

SHA256
ecf85e33fc8cc3b172c2f6743540976157059787d1e4f6f3ef49a61cb3805916

SHA512
a97fc94509c3700e148493b0878f20ad54f22f2e9e65dfccabfedfc649c812029eaaa7a46d02dfbb5116bbf6bc7f707ebffeaae2ef6624b63c651dfff7c9bb92

Download Submit
C:\Windows\sourro.exe

Filesize
21KB

MD5
e8236f96ab727e27ef90be4520ca7af8

SHA1
c59b32bf83d4ffca440a630503e49f44888c6358

SHA256
2f90e52b1eef556c894413492812580230a1a672b3abc7b60d10c1b76590c70a

SHA512
9823a218b4cf73ec223d583e276fc86d06ca32a1382c7a860d19aea6a80c9c3cfc8d58a60d372794f5d3139dabd2c48f440b332cfcc0c05cabe3a000d90f42aa

Download Submit
memory/1976-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1976-6-0x00000000001B0000-0x00000000001BD000-memory.dmp

Filesize
52KB

Download
memory/1976-12-0x0000000000260000-0x0000000000283000-memory.dmp

Filesize
140KB

Download
memory/1976-17-0x00000000001B0000-0x00000000001BD000-memory.dmp

Filesize
52KB

Download
memory/1976-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2764-19-0x00000000001B0000-0x00000000001BD000-memory.dmp

Filesize
52KB

Download
memory/2764-20-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download