modiloader | e5104dc11239aa64c8e9e33ff55e31867ef8266c2b92f8b391c95ba15f3d3d36

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-09-2024 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f294d03a79d93e821e79d934eca3033c_JaffaCakes118.exe
Size

227KB
MD5

f294d03a79d93e821e79d934eca3033c
SHA1

d057388f1291a728b77ac0f747a2504d3a74a4d0
SHA256

e5104dc11239aa64c8e9e33ff55e31867ef8266c2b92f8b391c95ba15f3d3d36
SHA512

666f6c50cab5282d2b6ede66b1aa8db49cefae58b7c4a0aaf22b0ad04e65202944efef75db3fafee8818ed903b3643582067afb64a89a1654db881ff5fae30a4
SSDEEP

3072:nMxu8ijNM4da9Jmr/K9mj3b783ijd2P9VMpnKXjb+S8gjrnxhDe2pF8yTO:MxupNZdq2ScKih2PPMpnEjbjjjPDjO

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/1580-8-0x0000000000400000-0x0000000000440000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
2748	server2.exe

Loads dropped DLL 7 IoCs

pid	Process
1580	f294d03a79d93e821e79d934eca3033c_JaffaCakes118.exe
1580	f294d03a79d93e821e79d934eca3033c_JaffaCakes118.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2720	2748	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f294d03a79d93e821e79d934eca3033c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2748	1580	f294d03a79d93e821e79d934eca3033c_JaffaCakes118.exe	30
PID 1580 wrote to memory of 2748	1580	f294d03a79d93e821e79d934eca3033c_JaffaCakes118.exe	30
PID 1580 wrote to memory of 2748	1580	f294d03a79d93e821e79d934eca3033c_JaffaCakes118.exe	30
PID 1580 wrote to memory of 2748	1580	f294d03a79d93e821e79d934eca3033c_JaffaCakes118.exe	30
PID 2748 wrote to memory of 2720	2748	server2.exe	31
PID 2748 wrote to memory of 2720	2748	server2.exe	31
PID 2748 wrote to memory of 2720	2748	server2.exe	31
PID 2748 wrote to memory of 2720	2748	server2.exe	31

C:\Users\Admin\AppData\Local\Temp\f294d03a79d93e821e79d934eca3033c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f294d03a79d93e821e79d934eca3033c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Users\Admin\AppData\Local\Temp\server2.exe
  "C:\Users\Admin\AppData\Local\Temp\server2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 124
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\server2.exe

Filesize
217KB

MD5
4830693637c242d3bb259f80df9aafc0

SHA1
d61fd8416f2de343a230798bf20b0105f5befd1b

SHA256
d9b7f548dd4afc47a5151fa113290deff51378643091d89b625c7a915f1e1b39

SHA512
b85fba0b25ef08b42c4076ca722e145ac161357fa11fef4ba62a35d7926b0f9beed36b02486bfc0d00ce2cc1d4970295c65e756969f55928c61aedd8b3736ae2

Download Submit
memory/1580-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2748-12-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2748-10-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/2748-13-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2748-15-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2748-14-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2748-21-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download