modiloader | 953a6f1717b1a04c52b2421418f5e239cf11f4e456b5c517c56892d3c8135847

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
Size

595KB
MD5

ebeb87b4fd2342e1c4973ff29e692752
SHA1

9b1e712590afa41ba09c70fdbaa4b47faae13177
SHA256

953a6f1717b1a04c52b2421418f5e239cf11f4e456b5c517c56892d3c8135847
SHA512

67af4c8d7911b65e2ca9fde8726413d81955f0eca999e62bd2f7dc9914be0d162b2a6e02941be79235165afe3272586ade67e1eef1a4ad00ff0404142f2cc239
SSDEEP

12288:FsOMDy+NI4HIhtESNBQfp0kKF3Z4mxxK0MHoTAFbd:CL+atosSbQfpKQmXKKG

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 5 IoCs

resource	yara_rule
behavioral1/memory/1716-54-0x0000000000400000-0x0000000000559000-memory.dmp	modiloader_stage2
behavioral1/memory/2620-83-0x0000000000400000-0x0000000000559000-memory.dmp	modiloader_stage2
behavioral1/memory/1716-92-0x0000000000400000-0x0000000000559000-memory.dmp	modiloader_stage2
behavioral1/memory/2620-101-0x0000000000400000-0x0000000000559000-memory.dmp	modiloader_stage2
behavioral1/memory/1716-115-0x0000000000400000-0x0000000000559000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
2568	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2620	Server.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\H:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\I:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\L:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\Q:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\X:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\Y:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\J:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\M:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\N:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\R:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\Z:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\B:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\E:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\O:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\V:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\G:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\K:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\P:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\S:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\T:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\U:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened (read-only)	\??\W:	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\AutoRun.inf	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File opened for modification	F:\AutoRun.inf	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_Server.exe	Server.exe
File opened for modification	C:\Windows\SysWOW64\_Server.exe	Server.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2620 set thread context of 380	2620	Server.exe	29

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Server.exe	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File created	C:\Windows\ReDelBat.bat	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
File created	C:\Windows\Server.exe	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
696	2620	WerFault.exe	28

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2620	1716	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe	28
PID 1716 wrote to memory of 2620	1716	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe	28
PID 1716 wrote to memory of 2620	1716	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe	28
PID 1716 wrote to memory of 2620	1716	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe	28
PID 2620 wrote to memory of 380	2620	Server.exe	29
PID 2620 wrote to memory of 380	2620	Server.exe	29
PID 2620 wrote to memory of 380	2620	Server.exe	29
PID 2620 wrote to memory of 380	2620	Server.exe	29
PID 2620 wrote to memory of 380	2620	Server.exe	29
PID 2620 wrote to memory of 380	2620	Server.exe	29
PID 2620 wrote to memory of 824	2620	Server.exe	30
PID 2620 wrote to memory of 824	2620	Server.exe	30
PID 2620 wrote to memory of 824	2620	Server.exe	30
PID 2620 wrote to memory of 824	2620	Server.exe	30
PID 2620 wrote to memory of 696	2620	Server.exe	31
PID 2620 wrote to memory of 696	2620	Server.exe	31
PID 2620 wrote to memory of 696	2620	Server.exe	31
PID 2620 wrote to memory of 696	2620	Server.exe	31
PID 1716 wrote to memory of 2568	1716	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe	34
PID 1716 wrote to memory of 2568	1716	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe	34
PID 1716 wrote to memory of 2568	1716	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe	34
PID 1716 wrote to memory of 2568	1716	ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe	34

C:\Users\Admin\AppData\Local\Temp\ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ebeb87b4fd2342e1c4973ff29e692752_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\Server.exe
  C:\Windows\Server.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\mstsc.exe
    "C:\Windows\system32\mstsc.exe"
    3⤵
    PID:380
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    PID:824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 312
    3⤵
    - Program crash
    PID:696
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\ReDelBat.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\AutoRun.inf

Filesize
166B

MD5
42e6ddc67c0c51a3e39780a99988f551

SHA1
3422a8dde772d662217339179f81ccb3686780d4

SHA256
f9c0462fff3f51f85aa116b2d0f38fd2a8e7263284a3bb1cde9b87a92abfaf01

SHA512
e1a316110a286ce72a8948e67b1c38e29cec73720780886873f00f0082ddee21557d8c7eb8106531f4cf0d3bf5b7945b60fe11f792e3ba70879e6a7063acea5b

Download Submit
C:\Windows\ReDelBat.bat

Filesize
212B

MD5
3a53526a37703dfe8645a48122f85a17

SHA1
f4388ba948b78f1c47bcaa2c9db8e808e6f9be5b

SHA256
25d66f23bafc031e45b52f1f904e2591e34c934c5e4eba2b2cfc85d74fb71b51

SHA512
e75a851a9bdf05b39d737f727756572c2f2f52d80b89e1a44811995b7e25969d4dc1b7c7a4081b1babb3c6be07cc98919426d3e416f0b2818a5dc975db1079d1

Download Submit
F:\Server.exe

Filesize
595KB

MD5
ebeb87b4fd2342e1c4973ff29e692752

SHA1
9b1e712590afa41ba09c70fdbaa4b47faae13177

SHA256
953a6f1717b1a04c52b2421418f5e239cf11f4e456b5c517c56892d3c8135847

SHA512
67af4c8d7911b65e2ca9fde8726413d81955f0eca999e62bd2f7dc9914be0d162b2a6e02941be79235165afe3272586ade67e1eef1a4ad00ff0404142f2cc239

Download Submit
memory/380-87-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/380-90-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/1716-19-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-45-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-48-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-47-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-46-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-15-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/1716-44-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-43-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-42-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-14-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/1716-40-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-39-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-38-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-37-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-36-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-35-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-34-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-33-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-32-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-31-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-30-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-29-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-28-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-27-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-26-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-25-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-24-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-23-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-22-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-21-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-20-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-0-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/1716-18-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-17-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-99-0x0000000004390000-0x00000000044E9000-memory.dmp

Filesize
1.3MB

Download
memory/1716-49-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-41-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-13-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/1716-12-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/1716-11-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/1716-10-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/1716-9-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/1716-8-0x0000000002120000-0x0000000002121000-memory.dmp

Filesize
4KB

Download
memory/1716-7-0x0000000002130000-0x0000000002131000-memory.dmp

Filesize
4KB

Download
memory/1716-6-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download
memory/1716-5-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/1716-4-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/1716-3-0x00000000020B0000-0x00000000020B1000-memory.dmp

Filesize
4KB

Download
memory/1716-2-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/1716-54-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/1716-50-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-51-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-115-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/1716-80-0x0000000004390000-0x00000000044E9000-memory.dmp

Filesize
1.3MB

Download
memory/1716-82-0x0000000004390000-0x00000000044E9000-memory.dmp

Filesize
1.3MB

Download
memory/1716-1-0x00000000005C0000-0x0000000000614000-memory.dmp

Filesize
336KB

Download
memory/1716-52-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-53-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-92-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/1716-93-0x00000000005C0000-0x0000000000614000-memory.dmp

Filesize
336KB

Download
memory/1716-98-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/1716-97-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/1716-96-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/1716-95-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/1716-94-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/1716-16-0x00000000033D0000-0x00000000033D1000-memory.dmp

Filesize
4KB

Download
memory/2620-101-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/2620-83-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download
memory/2620-81-0x0000000000400000-0x0000000000559000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads