modiloader | 1366ed9d181a80404b5f8524833dfebc17f8b00ee2071764c50bd4d21fde4b75

Analysis

max time kernel
95s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed119e92ac5b9b0efcba54ae2976fff5_JaffaCakes118.exe
Size

224KB
MD5

ed119e92ac5b9b0efcba54ae2976fff5
SHA1

1652eecb7c54a0ea121f1205c0ab880cf770fa93
SHA256

1366ed9d181a80404b5f8524833dfebc17f8b00ee2071764c50bd4d21fde4b75
SHA512

37c143c48bafa2e6afad1b9556f27167400f58a35238927cb65a2e224905c5f0d07403578dba2458d6bd2369b6771bc1b7eb3d29481c7e21596815645ed6c29e
SSDEEP

6144:p8jZ7rS2SdkT37by4pZ2+oSnrceAEab4wAIAHq3:pe0lA3C4pZNoSrcVE9fK

Score

10^/10

modiloader discovery trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/2216-12-0x0000000000400000-0x0000000000473000-memory.dmp	modiloader_stage2

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2216-0-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/2216-12-0x0000000000400000-0x0000000000473000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2076	2216	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed119e92ac5b9b0efcba54ae2976fff5_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ed119e92ac5b9b0efcba54ae2976fff5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ed119e92ac5b9b0efcba54ae2976fff5_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 632
  2⤵
  - Program crash
  PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2216 -ip 2216
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\jI82l\PCGWIN32.LI5

Filesize
2KB

MD5
bb017d1bd188d345870c0dbaa8577917

SHA1
699a691dd71cb024865e52f374aac090d172e8cb

SHA256
1994774fb986c80181c6e57d3811ff688b59644c49e7458de7322d6d3d6dff16

SHA512
da158f24a7c2929c57be09f6935d25feb6af118f90ca6f0f1050e58952d2e7042fffa2c64c49ab0aab1ce5581648b712278517e783e30954c577f15027513368

Download Submit
memory/2216-0-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2216-12-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download