modiloader | 5a97f196f19f00067daf65082dab3eceea9f82374d409a65a6555f48b8fa2e91

Analysis

max time kernel
141s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 09:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8d04fb3da70d1909470cb64ff7745c9_JaffaCakes118.exe
Size

97KB
MD5

e8d04fb3da70d1909470cb64ff7745c9
SHA1

857b690e5ecd7215a353112c823aaa32f35bc777
SHA256

5a97f196f19f00067daf65082dab3eceea9f82374d409a65a6555f48b8fa2e91
SHA512

e7f68812eeedb0dec57c3865c870e3240b64828cde5dcc437af81e6bb1a02a55b1e1ec4877b155434d5403843d2da851a2ff16bb7e11e1a35af452027fa6368d
SSDEEP

1536:E+5ng+pfYpirWD+fBD8w//qZxNdD5St5TvtbdAMv8+QtLtRiAroDU:E+5ngSfYpWzpD8kqLNStVvbQhQ

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/3420-15-0x0000000000400000-0x0000000000420000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	e8d04fb3da70d1909470cb64ff7745c9_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
2728	äÓÎ ãä Sexy-Girls-hot.exe
1924	bbb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2056	2728	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8d04fb3da70d1909470cb64ff7745c9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	äÓÎ ãä Sexy-Girls-hot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bbb.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1924	bbb.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 2728	3420	e8d04fb3da70d1909470cb64ff7745c9_JaffaCakes118.exe	89
PID 3420 wrote to memory of 2728	3420	e8d04fb3da70d1909470cb64ff7745c9_JaffaCakes118.exe	89
PID 3420 wrote to memory of 2728	3420	e8d04fb3da70d1909470cb64ff7745c9_JaffaCakes118.exe	89
PID 3420 wrote to memory of 1924	3420	e8d04fb3da70d1909470cb64ff7745c9_JaffaCakes118.exe	90
PID 3420 wrote to memory of 1924	3420	e8d04fb3da70d1909470cb64ff7745c9_JaffaCakes118.exe	90
PID 3420 wrote to memory of 1924	3420	e8d04fb3da70d1909470cb64ff7745c9_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\e8d04fb3da70d1909470cb64ff7745c9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e8d04fb3da70d1909470cb64ff7745c9_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Users\Admin\AppData\Local\Temp\äÓÎ ãä Sexy-Girls-hot.exe
  "C:\Users\Admin\AppData\Local\Temp\äÓÎ ãä Sexy-Girls-hot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 216
    3⤵
    - Program crash
    PID:2056
- C:\Users\Admin\AppData\Local\Temp\bbb.exe
  "C:\Users\Admin\AppData\Local\Temp\bbb.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2728 -ip 2728
1⤵
PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1904,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
1⤵
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bbb.exe

Filesize
7KB

MD5
8524724985250341f25c7a99b279ee0d

SHA1
a58a9ffc41cf4e2e1d4bf17b2dac26fd4b36443a

SHA256
0b06ee9b0244043f093845846a4af4dac93177c71842655f644b7c9d17580725

SHA512
ac8e4fb4ed3b32d524663cfb9a227b513a0f7b190f7e635e23ee0c5f1dd928d75537f5613f0a8129e53ea332224e3daf3d6c69cc2deffe72017601d670b6d937

Download Submit
C:\Users\Admin\AppData\Local\Temp\äÓÎ ãä Sexy-Girls-hot.exe

Filesize
71KB

MD5
b3403b39b86a14124f1848ffdf69d241

SHA1
6e8ed231482fb9fde3146db734b53ce61a1c43b5

SHA256
45647d2835bb141665ce8b07ed514e6c9c353306cb5f84f186782901cd7cda47

SHA512
54f4f8b047a46d023e0d17303971b16b4fb806530145061a6fe83038d264d2adce0d5d547c06b15560a984518223fa90485029e5a60c958f266b494150261f25

Download Submit
memory/1924-18-0x0000000000400000-0x0000000000401C00-memory.dmp

Filesize
7KB

Download
memory/2728-17-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3420-15-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download