modiloader | 644bc927f7dc7ec791e9f2a8f2b4f664f6ff210c87d8a7f9262da59125350332

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec091e865d60694b260455ec1edac80b_JaffaCakes118.exe
Size

36KB
MD5

ec091e865d60694b260455ec1edac80b
SHA1

b45803a6b63a0749913ddb9c88331aaeab9f251a
SHA256

644bc927f7dc7ec791e9f2a8f2b4f664f6ff210c87d8a7f9262da59125350332
SHA512

fa88cb26dc300a5a0249b384148cba156522073954d9fc9ee064afc1f6cd4f1778cba2b1c39204b60cebb84552ca06071736066fade147c1b35539289fad49cc
SSDEEP

768:SJT4n0+DN8zjxig+6xt+SOduIdaXKxLmGQj1DIjcA:qUn13H8zTj1DXA

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/1992-5-0x0000000010000000-0x0000000010010000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1992 set thread context of 2316	1992	ec091e865d60694b260455ec1edac80b_JaffaCakes118.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec091e865d60694b260455ec1edac80b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2316	1992	ec091e865d60694b260455ec1edac80b_JaffaCakes118.exe	87
PID 1992 wrote to memory of 2316	1992	ec091e865d60694b260455ec1edac80b_JaffaCakes118.exe	87
PID 1992 wrote to memory of 2316	1992	ec091e865d60694b260455ec1edac80b_JaffaCakes118.exe	87
PID 1992 wrote to memory of 2316	1992	ec091e865d60694b260455ec1edac80b_JaffaCakes118.exe	87
PID 1992 wrote to memory of 2316	1992	ec091e865d60694b260455ec1edac80b_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\ec091e865d60694b260455ec1edac80b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ec091e865d60694b260455ec1edac80b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\ec091e865d60694b260455ec1edac80b_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\ec091e865d60694b260455ec1edac80b_JaffaCakes118.exe
  2⤵
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1992-5-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2316-1-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2316-6-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2316-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2316-7-0x0000000000020000-0x0000000000031000-memory.dmp

Filesize
68KB

Download