modiloader | 90e166067e9c4feaae98bd81cd7f875010a25061dab66d42889ac189209922a3

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e93a469dde72e2eb511f7b351a8626fc_JaffaCakes118.exe
Size

25KB
MD5

e93a469dde72e2eb511f7b351a8626fc
SHA1

c00642aa2193090301e58ba8b5000dec2f92ffa3
SHA256

90e166067e9c4feaae98bd81cd7f875010a25061dab66d42889ac189209922a3
SHA512

a177de96d0221b2191c0045218838a59f1aa7b6c644538d1535310f1fa1187f1e5c25c27c32865d02440f3b8e64656f9424044489d0794866e010c72f40f6816
SSDEEP

384:0wm+8TpFywSLQjzu/RQ+mLyvXYu5+z0Y3wil6NPgrE+Ioqf+E/Uu:0TJpFHSLyupC2/kzww/zIGE/X

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/memory/2596-13-0x0000000000400000-0x0000000000424000-memory.dmp	modiloader_stage2
behavioral1/memory/2428-10-0x0000000000400000-0x0000000000424000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
2428	winwm.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\kulionwm.dll	e93a469dde72e2eb511f7b351a8626fc_JaffaCakes118.exe
File created	C:\Windows\winwm.exe	e93a469dde72e2eb511f7b351a8626fc_JaffaCakes118.exe
File opened for modification	C:\Windows\winwm.exe	e93a469dde72e2eb511f7b351a8626fc_JaffaCakes118.exe
File created	C:\Windows\kulionwm.dll	winwm.exe
File created	C:\Windows\winwm.exe	winwm.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e93a469dde72e2eb511f7b351a8626fc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winwm.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2428	2596	e93a469dde72e2eb511f7b351a8626fc_JaffaCakes118.exe	30
PID 2596 wrote to memory of 2428	2596	e93a469dde72e2eb511f7b351a8626fc_JaffaCakes118.exe	30
PID 2596 wrote to memory of 2428	2596	e93a469dde72e2eb511f7b351a8626fc_JaffaCakes118.exe	30
PID 2596 wrote to memory of 2428	2596	e93a469dde72e2eb511f7b351a8626fc_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\e93a469dde72e2eb511f7b351a8626fc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e93a469dde72e2eb511f7b351a8626fc_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\winwm.exe
  C:\Windows\winwm.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\kulionwm.dll

Filesize
27KB

MD5
efde8da0d675827cd92fe82d193e7997

SHA1
0ccf71a4f0e48088543639332b2d428fcc3807ae

SHA256
672081e9f8016b4a31f9b81d6236a22535d1d6cea5af9b300a3546fa0afb7cd6

SHA512
a15d526f50dbeab235851b1c93fc8ebb0b3273473fd66dde8933c3c7047fb2707ac1a9add310a85e06b67fdf243cc0a0b6f3356a2cc7fed7291fcea05a17ebe1

Download Submit
C:\Windows\winwm.exe

Filesize
25KB

MD5
e93a469dde72e2eb511f7b351a8626fc

SHA1
c00642aa2193090301e58ba8b5000dec2f92ffa3

SHA256
90e166067e9c4feaae98bd81cd7f875010a25061dab66d42889ac189209922a3

SHA512
a177de96d0221b2191c0045218838a59f1aa7b6c644538d1535310f1fa1187f1e5c25c27c32865d02440f3b8e64656f9424044489d0794866e010c72f40f6816

Download Submit
memory/2428-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2596-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2596-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2596-12-0x0000000000220000-0x0000000000244000-memory.dmp

Filesize
144KB

Download
memory/2596-11-0x0000000000220000-0x0000000000244000-memory.dmp

Filesize
144KB

Download