modiloader | eda0acbe7fd372cfd56c0333bd22f1f1f90ac2734e86b2cd970ff1ce58ee4ec7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
Size

807KB
MD5

ec1b50f96fe9dc4b0448bc2b5eef7675
SHA1

b084ee34f8513afa92feb9c53c2a85fb115ba2cb
SHA256

eda0acbe7fd372cfd56c0333bd22f1f1f90ac2734e86b2cd970ff1ce58ee4ec7
SHA512

2ad2f13fefa6487204a80c2a35d96f999239bc8233348be6a087ad9d7b6a118f03720538552c66b43552de2a2fd364f30b9530aaef58a1c2f755e6a420fc8c59
SSDEEP

24576:Bo6BK1MONvRPZ8TDURgq38ZskBU65vEaQgxtR:BrqJhSDagq8/xFQ6r

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral1/memory/2792-78-0x0000000000400000-0x00000000006D7000-memory.dmp	modiloader_stage2
behavioral1/memory/2536-92-0x0000000000400000-0x00000000006D7000-memory.dmp	modiloader_stage2
behavioral1/memory/2792-101-0x0000000000400000-0x00000000006D7000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
2000	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2536	wxd.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\Y:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\A:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\B:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\M:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\T:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\U:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\S:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\E:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\H:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\K:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\N:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\R:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\I:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\Q:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\Z:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\W:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\X:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\G:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\J:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\L:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\O:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened (read-only)	\??\P:	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\AutoRun.inf	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened for modification	C:\AutoRun.inf	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File created	F:\AutoRun.inf	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File opened for modification	F:\AutoRun.inf	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_wxd.exe	wxd.exe
File opened for modification	C:\Windows\SysWOW64\_wxd.exe	wxd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2536 set thread context of 1748	2536	wxd.exe	29

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\wxd.exe	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File created	C:\Windows\DelSvel.bat	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
File created	C:\Windows\wxd.exe	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	2536	WerFault.exe	28

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wxd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2536	2792	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe	28
PID 2792 wrote to memory of 2536	2792	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe	28
PID 2792 wrote to memory of 2536	2792	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe	28
PID 2792 wrote to memory of 2536	2792	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe	28
PID 2536 wrote to memory of 1748	2536	wxd.exe	29
PID 2536 wrote to memory of 1748	2536	wxd.exe	29
PID 2536 wrote to memory of 1748	2536	wxd.exe	29
PID 2536 wrote to memory of 1748	2536	wxd.exe	29
PID 2536 wrote to memory of 1748	2536	wxd.exe	29
PID 2536 wrote to memory of 1748	2536	wxd.exe	29
PID 2536 wrote to memory of 1988	2536	wxd.exe	30
PID 2536 wrote to memory of 1988	2536	wxd.exe	30
PID 2536 wrote to memory of 1988	2536	wxd.exe	30
PID 2536 wrote to memory of 1988	2536	wxd.exe	30
PID 2792 wrote to memory of 2000	2792	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe	33
PID 2792 wrote to memory of 2000	2792	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe	33
PID 2792 wrote to memory of 2000	2792	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe	33
PID 2792 wrote to memory of 2000	2792	ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ec1b50f96fe9dc4b0448bc2b5eef7675_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\wxd.exe
  C:\Windows\wxd.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:1748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 300
    3⤵
    - Program crash
    PID:1988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\DelSvel.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\DelSvel.bat

Filesize
212B

MD5
97e3983834c1d51bfb2b9de0f7986396

SHA1
c645a3111ccfd46adac82a10297019da02269f3a

SHA256
3bc5ecf545545462c04bf2659fd978effb9e343f58c4fbce899b93cc26faa0a1

SHA512
f9af09642ce1acae265e2e55bf121da568beed49d6c2664f1ade74801784e190711f987a9d1985cb4a7e57e9cd47905487acf2e7ba5939fde63e1f6f54ac5f0d

Download Submit
F:\wxd.exe

Filesize
807KB

MD5
ec1b50f96fe9dc4b0448bc2b5eef7675

SHA1
b084ee34f8513afa92feb9c53c2a85fb115ba2cb

SHA256
eda0acbe7fd372cfd56c0333bd22f1f1f90ac2734e86b2cd970ff1ce58ee4ec7

SHA512
2ad2f13fefa6487204a80c2a35d96f999239bc8233348be6a087ad9d7b6a118f03720538552c66b43552de2a2fd364f30b9530aaef58a1c2f755e6a420fc8c59

Download Submit
memory/1748-82-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1748-83-0x0000000000400000-0x00000000006D7000-memory.dmp

Filesize
2.8MB

Download
memory/1748-85-0x0000000000400000-0x00000000006D7000-memory.dmp

Filesize
2.8MB

Download
memory/2536-77-0x0000000000400000-0x00000000006D7000-memory.dmp

Filesize
2.8MB

Download
memory/2536-92-0x0000000000400000-0x00000000006D7000-memory.dmp

Filesize
2.8MB

Download
memory/2792-32-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-60-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2792-27-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-37-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-40-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-28-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-59-0x0000000003550000-0x0000000003551000-memory.dmp

Filesize
4KB

Download
memory/2792-58-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2792-57-0x0000000003560000-0x0000000003561000-memory.dmp

Filesize
4KB

Download
memory/2792-56-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2792-26-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-54-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2792-53-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2792-52-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2792-51-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2792-50-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2792-49-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2792-48-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2792-47-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2792-46-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2792-45-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2792-44-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2792-43-0x0000000003540000-0x0000000003543000-memory.dmp

Filesize
12KB

Download
memory/2792-42-0x0000000003640000-0x0000000003641000-memory.dmp

Filesize
4KB

Download
memory/2792-41-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-39-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-38-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-36-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-35-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-29-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-33-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-2-0x00000000006E0000-0x0000000000734000-memory.dmp

Filesize
336KB

Download
memory/2792-31-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-30-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-34-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-3-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/2792-55-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/2792-25-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-24-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-23-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-22-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-21-0x0000000003640000-0x0000000003641000-memory.dmp

Filesize
4KB

Download
memory/2792-20-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-19-0x0000000003550000-0x0000000003551000-memory.dmp

Filesize
4KB

Download
memory/2792-18-0x0000000003550000-0x0000000003551000-memory.dmp

Filesize
4KB

Download
memory/2792-17-0x0000000003550000-0x0000000003551000-memory.dmp

Filesize
4KB

Download
memory/2792-16-0x0000000003550000-0x0000000003551000-memory.dmp

Filesize
4KB

Download
memory/2792-15-0x0000000003550000-0x0000000003551000-memory.dmp

Filesize
4KB

Download
memory/2792-14-0x0000000003550000-0x0000000003551000-memory.dmp

Filesize
4KB

Download
memory/2792-13-0x0000000003550000-0x0000000003551000-memory.dmp

Filesize
4KB

Download
memory/2792-12-0x0000000003540000-0x0000000003640000-memory.dmp

Filesize
1024KB

Download
memory/2792-11-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2792-10-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/2792-9-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/2792-8-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/2792-7-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2792-6-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2792-5-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/2792-4-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2792-78-0x0000000000400000-0x00000000006D7000-memory.dmp

Filesize
2.8MB

Download
memory/2792-76-0x0000000004890000-0x0000000004B67000-memory.dmp

Filesize
2.8MB

Download
memory/2792-87-0x0000000003540000-0x0000000003640000-memory.dmp

Filesize
1024KB

Download
memory/2792-88-0x00000000006E0000-0x0000000000734000-memory.dmp

Filesize
336KB

Download
memory/2792-89-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2792-90-0x0000000003640000-0x0000000003641000-memory.dmp

Filesize
4KB

Download
memory/2792-91-0x0000000004890000-0x0000000004B67000-memory.dmp

Filesize
2.8MB

Download
memory/2792-1-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2792-0-0x0000000000400000-0x00000000006D7000-memory.dmp

Filesize
2.8MB

Download
memory/2792-101-0x0000000000400000-0x00000000006D7000-memory.dmp

Filesize
2.8MB

Download
memory/2792-102-0x00000000006E0000-0x0000000000734000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads