modiloader | e5104dc11239aa64c8e9e33ff55e31867ef8266c2b92f8b391c95ba15f3d3d36

Analysis

max time kernel
94s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-09-2024 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f294d03a79d93e821e79d934eca3033c_JaffaCakes118.exe
Size

227KB
MD5

f294d03a79d93e821e79d934eca3033c
SHA1

d057388f1291a728b77ac0f747a2504d3a74a4d0
SHA256

e5104dc11239aa64c8e9e33ff55e31867ef8266c2b92f8b391c95ba15f3d3d36
SHA512

666f6c50cab5282d2b6ede66b1aa8db49cefae58b7c4a0aaf22b0ad04e65202944efef75db3fafee8818ed903b3643582067afb64a89a1654db881ff5fae30a4
SSDEEP

3072:nMxu8ijNM4da9Jmr/K9mj3b783ijd2P9VMpnKXjb+S8gjrnxhDe2pF8yTO:MxupNZdq2ScKih2PPMpnEjbjjjPDjO

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/620-11-0x0000000000400000-0x0000000000440000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	f294d03a79d93e821e79d934eca3033c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4092	server2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	4092	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f294d03a79d93e821e79d934eca3033c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 4092	620	f294d03a79d93e821e79d934eca3033c_JaffaCakes118.exe	82
PID 620 wrote to memory of 4092	620	f294d03a79d93e821e79d934eca3033c_JaffaCakes118.exe	82
PID 620 wrote to memory of 4092	620	f294d03a79d93e821e79d934eca3033c_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\f294d03a79d93e821e79d934eca3033c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f294d03a79d93e821e79d934eca3033c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:620
- C:\Users\Admin\AppData\Local\Temp\server2.exe
  "C:\Users\Admin\AppData\Local\Temp\server2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 324
    3⤵
    - Program crash
    PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4092 -ip 4092
1⤵
PID:3216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server2.exe

Filesize
217KB

MD5
4830693637c242d3bb259f80df9aafc0

SHA1
d61fd8416f2de343a230798bf20b0105f5befd1b

SHA256
d9b7f548dd4afc47a5151fa113290deff51378643091d89b625c7a915f1e1b39

SHA512
b85fba0b25ef08b42c4076ca722e145ac161357fa11fef4ba62a35d7926b0f9beed36b02486bfc0d00ce2cc1d4970295c65e756969f55928c61aedd8b3736ae2

Download Submit
memory/620-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4092-13-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4092-15-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4092-14-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4092-12-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/4092-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download