modiloader | 14c2f652ef5192d02ae54871ce0cafb1524e72a22c5b9fb2e8a071b5b3e21605

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-09-2024 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3439dffb967ccbdc9e750fdd660102b_JaffaCakes118.exe
Size

695KB
MD5

f3439dffb967ccbdc9e750fdd660102b
SHA1

450cd2374d4e642909f13f59183aae9e54f9e452
SHA256

14c2f652ef5192d02ae54871ce0cafb1524e72a22c5b9fb2e8a071b5b3e21605
SHA512

e155094e8288d1ea7254e8963e6eeda91ac6ad931db5c2355fa7b98dac6c6076b51f4e9dee06d85bcd80c91bab40183a27a8ac2ccdfda20b802ae5a2a4c62bf7
SSDEEP

12288:3cB1O10ew52MyWOT7QisDFF3Z4mxxP0MHoTAFbp:3IO15g2MyoFQmXPKa

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000012117-19.dat	modiloader_stage2
behavioral1/memory/1376-29-0x0000000000400000-0x00000000004B9000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
1376	11.exe

Loads dropped DLL 2 IoCs

pid	Process
2916	f3439dffb967ccbdc9e750fdd660102b_JaffaCakes118.exe
2916	f3439dffb967ccbdc9e750fdd660102b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3439dffb967ccbdc9e750fdd660102b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 1376	2916	f3439dffb967ccbdc9e750fdd660102b_JaffaCakes118.exe	30
PID 2916 wrote to memory of 1376	2916	f3439dffb967ccbdc9e750fdd660102b_JaffaCakes118.exe	30
PID 2916 wrote to memory of 1376	2916	f3439dffb967ccbdc9e750fdd660102b_JaffaCakes118.exe	30
PID 2916 wrote to memory of 1376	2916	f3439dffb967ccbdc9e750fdd660102b_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\f3439dffb967ccbdc9e750fdd660102b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3439dffb967ccbdc9e750fdd660102b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\11.exe
  "C:\Users\Admin\AppData\Local\Temp\11.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\11.exe

Filesize
673KB

MD5
9cee595a5c82c96e836294c036a133b2

SHA1
1d42d8d2a6691c1b7bf4af710a5dba93df66e8bb

SHA256
5cb28470537390ae1ea457e07f4ee4f6d49980144b6a5e548ad960a49af982c5

SHA512
1e926e2a30cc4a54b1b8368061f8528a685403d18dbcf30e7002ca6eaeceb8eb0a97cc805601e402fa789d5743394e3cfce4a23d3ff8b23405c61fac533a5707

Download Submit
memory/1376-29-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/2916-17-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/2916-16-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/2916-7-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/2916-6-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2916-5-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2916-4-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/2916-3-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/2916-2-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/2916-0-0x0000000000400000-0x0000000000502000-memory.dmp

Filesize
1.0MB

Download
memory/2916-8-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/2916-15-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2916-14-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/2916-13-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/2916-12-0x0000000003230000-0x0000000003231000-memory.dmp

Filesize
4KB

Download
memory/2916-11-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/2916-9-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2916-1-0x0000000000300000-0x0000000000354000-memory.dmp

Filesize
336KB

Download
memory/2916-28-0x0000000000400000-0x0000000000502000-memory.dmp

Filesize
1.0MB

Download
memory/2916-26-0x0000000000300000-0x0000000000354000-memory.dmp

Filesize
336KB

Download