modiloader | 14c2f652ef5192d02ae54871ce0cafb1524e72a22c5b9fb2e8a071b5b3e21605

Analysis

max time kernel
95s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-09-2024 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3439dffb967ccbdc9e750fdd660102b_JaffaCakes118.exe
Size

695KB
MD5

f3439dffb967ccbdc9e750fdd660102b
SHA1

450cd2374d4e642909f13f59183aae9e54f9e452
SHA256

14c2f652ef5192d02ae54871ce0cafb1524e72a22c5b9fb2e8a071b5b3e21605
SHA512

e155094e8288d1ea7254e8963e6eeda91ac6ad931db5c2355fa7b98dac6c6076b51f4e9dee06d85bcd80c91bab40183a27a8ac2ccdfda20b802ae5a2a4c62bf7
SSDEEP

12288:3cB1O10ew52MyWOT7QisDFF3Z4mxxP0MHoTAFbp:3IO15g2MyoFQmXPKa

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/files/0x000900000002343c-20.dat	modiloader_stage2
behavioral2/memory/3204-26-0x0000000000400000-0x00000000004B9000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	f3439dffb967ccbdc9e750fdd660102b_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3204	11.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2316	3204	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3439dffb967ccbdc9e750fdd660102b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 3204	1140	f3439dffb967ccbdc9e750fdd660102b_JaffaCakes118.exe	82
PID 1140 wrote to memory of 3204	1140	f3439dffb967ccbdc9e750fdd660102b_JaffaCakes118.exe	82
PID 1140 wrote to memory of 3204	1140	f3439dffb967ccbdc9e750fdd660102b_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\f3439dffb967ccbdc9e750fdd660102b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3439dffb967ccbdc9e750fdd660102b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Local\Temp\11.exe
  "C:\Users\Admin\AppData\Local\Temp\11.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 536
    3⤵
    - Program crash
    PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3204 -ip 3204
1⤵
PID:3852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\11.exe

Filesize
673KB

MD5
9cee595a5c82c96e836294c036a133b2

SHA1
1d42d8d2a6691c1b7bf4af710a5dba93df66e8bb

SHA256
5cb28470537390ae1ea457e07f4ee4f6d49980144b6a5e548ad960a49af982c5

SHA512
1e926e2a30cc4a54b1b8368061f8528a685403d18dbcf30e7002ca6eaeceb8eb0a97cc805601e402fa789d5743394e3cfce4a23d3ff8b23405c61fac533a5707

Download Submit
memory/1140-7-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/1140-3-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1140-8-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/1140-14-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/1140-12-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/1140-11-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/1140-10-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1140-9-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/1140-15-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/1140-0-0x0000000000400000-0x0000000000502000-memory.dmp

Filesize
1.0MB

Download
memory/1140-5-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/1140-6-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/1140-4-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/1140-13-0x00000000034F0000-0x00000000034F1000-memory.dmp

Filesize
4KB

Download
memory/1140-2-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/1140-1-0x0000000000B30000-0x0000000000B84000-memory.dmp

Filesize
336KB

Download
memory/1140-23-0x0000000000400000-0x0000000000502000-memory.dmp

Filesize
1.0MB

Download
memory/1140-25-0x0000000000B30000-0x0000000000B84000-memory.dmp

Filesize
336KB

Download
memory/3204-26-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download