modiloader | 5fb712bf3dbf2945f7b4a4e53648ccd12b7ec54258dd0c8c84c3400eeb282aae

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb33251c5bb482504bd24560d5277695_JaffaCakes118.exe
Size

27KB
MD5

eb33251c5bb482504bd24560d5277695
SHA1

b3aab57a661e23b67e9c663e240dd34643f7bd57
SHA256

5fb712bf3dbf2945f7b4a4e53648ccd12b7ec54258dd0c8c84c3400eeb282aae
SHA512

c43f280e3069505f63ab095c8699c776d9c581c5713a2aa8a65a3cbc372da7c9c9f9e2854206c697cd3f1b464143a3e74d8f2a0f5de94afd0f8d79905a822c1c
SSDEEP

384:8KoA0iaVZAszu/RQ+mLyvXYu5+z0Y5cQcEX2FHoM0K3qND0MEuq2NE9mvnTDJ5eO:7oTHupC2/kB5cWmFIM050MBq2yIDJcO

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/844-14-0x0000000000400000-0x0000000000425000-memory.dmp	modiloader_stage2
behavioral2/memory/4068-16-0x0000000000400000-0x0000000000425000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
4068	ow.exe

Loads dropped DLL 2 IoCs

pid	Process
4068	ow.exe
4068	ow.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb33251c5bb482504bd24560d5277695_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ow.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4068	ow.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 4068	844	eb33251c5bb482504bd24560d5277695_JaffaCakes118.exe	82
PID 844 wrote to memory of 4068	844	eb33251c5bb482504bd24560d5277695_JaffaCakes118.exe	82
PID 844 wrote to memory of 4068	844	eb33251c5bb482504bd24560d5277695_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\eb33251c5bb482504bd24560d5277695_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb33251c5bb482504bd24560d5277695_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:844
- C:\RECYCLER\ow.exe
  C:\RECYCLER\ow.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\RECYCLER\ow.dll

Filesize
32KB

MD5
749f5c8ea788fc4aa90c92cad5c2c026

SHA1
5cbd1b3178a1681296bae548bc52ece8256df1da

SHA256
b220fe20ad027c52bda9ff829701b1657bc053a4e380ecff48d8d2700f6a30b0

SHA512
40c25b60285582459b1609ba3f5e9cbff7370557b0a9f5a9220ccd0be994330a586b1774c9fc59abd25af058e2f58248deaabc5b4432c16d283f8a8a263797ea

Download Submit
C:\RECYCLER\ow.exe

Filesize
27KB

MD5
eb33251c5bb482504bd24560d5277695

SHA1
b3aab57a661e23b67e9c663e240dd34643f7bd57

SHA256
5fb712bf3dbf2945f7b4a4e53648ccd12b7ec54258dd0c8c84c3400eeb282aae

SHA512
c43f280e3069505f63ab095c8699c776d9c581c5713a2aa8a65a3cbc372da7c9c9f9e2854206c697cd3f1b464143a3e74d8f2a0f5de94afd0f8d79905a822c1c

Download Submit
memory/844-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/844-14-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4068-11-0x00000000004B0000-0x00000000004BE000-memory.dmp

Filesize
56KB

Download
memory/4068-15-0x00000000004B0000-0x00000000004BE000-memory.dmp

Filesize
56KB

Download
memory/4068-16-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download