modiloader | 485a4b4fcb0f7f52c4f78daa2c93e3255552a576c8f25392f1b666df31332748

Analysis

max time kernel
125s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f563f00b91d1ef4525f378fd326f3afa_JaffaCakes118.exe
Size

666KB
MD5

f563f00b91d1ef4525f378fd326f3afa
SHA1

0ec5d7ee5e4cd2ed8b878f676a9d0df59dad0868
SHA256

485a4b4fcb0f7f52c4f78daa2c93e3255552a576c8f25392f1b666df31332748
SHA512

bec36461db9cb7418a4b2ad3e3e987f1fe604ad7a517be8cbbce72698e8e71729900a8bd3989b7b965c6e772ccc596b6811cc9838d63b5d16dc770a7fe2b0214
SSDEEP

12288:BdRa/eAHYDS5IDrFVSSyX6axhh9Ms2CF3Z4mxxESi7hG2h98PB3m6u/iO:U/Z4oIDr3pB67TpQmXELG2ho6

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/3792-66-0x0000000000400000-0x00000000004BB000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	f563f00b91d1ef4525f378fd326f3afa_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3792	a.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt	a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f563f00b91d1ef4525f378fd326f3afa_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 3792	3208	f563f00b91d1ef4525f378fd326f3afa_JaffaCakes118.exe	89
PID 3208 wrote to memory of 3792	3208	f563f00b91d1ef4525f378fd326f3afa_JaffaCakes118.exe	89
PID 3208 wrote to memory of 3792	3208	f563f00b91d1ef4525f378fd326f3afa_JaffaCakes118.exe	89
PID 3792 wrote to memory of 2756	3792	a.exe	90
PID 3792 wrote to memory of 2756	3792	a.exe	90

C:\Users\Admin\AppData\Local\Temp\f563f00b91d1ef4525f378fd326f3afa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f563f00b91d1ef4525f378fd326f3afa_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Users\Admin\AppData\Local\Temp\a.exe
  "C:\Users\Admin\AppData\Local\Temp\a.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    PID:2756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1284,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:8
1⤵
PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a.exe

Filesize
352KB

MD5
09d21e741f4beb223097d7dddb7d9f6c

SHA1
b24811ed9ac617913d5c2fe8e802902fc367b1b4

SHA256
ed79c1ef14dd5da1c39d3534e9df608327548fee0935ac1885380a3c5916af18

SHA512
3aea6b6eeb0aaa6f82b233ce8e0e36cf9db4ad44914133a69f22a1f2534315cb6c6c09311410937c4f169f935ac5f033d374e3f1a6fbce0e1e678ec865279acd

Download Submit
memory/3208-0-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3208-1-0x00000000022A0000-0x00000000022F4000-memory.dmp

Filesize
336KB

Download
memory/3208-30-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/3208-29-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/3208-28-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/3208-48-0x0000000003430000-0x0000000003431000-memory.dmp

Filesize
4KB

Download
memory/3208-49-0x0000000003430000-0x0000000003431000-memory.dmp

Filesize
4KB

Download
memory/3208-47-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3208-46-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/3208-45-0x0000000003430000-0x0000000003431000-memory.dmp

Filesize
4KB

Download
memory/3208-44-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3208-50-0x0000000003430000-0x0000000003431000-memory.dmp

Filesize
4KB

Download
memory/3208-43-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3208-42-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3208-53-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/3208-52-0x0000000003420000-0x0000000003422000-memory.dmp

Filesize
8KB

Download
memory/3208-41-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3208-40-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3208-39-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/3208-51-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/3208-38-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/3208-37-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/3208-36-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/3208-35-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/3208-34-0x0000000003430000-0x0000000003431000-memory.dmp

Filesize
4KB

Download
memory/3208-33-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/3208-27-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/3208-26-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/3208-25-0x0000000003430000-0x0000000003431000-memory.dmp

Filesize
4KB

Download
memory/3208-24-0x0000000003430000-0x0000000003431000-memory.dmp

Filesize
4KB

Download
memory/3208-23-0x0000000003430000-0x0000000003431000-memory.dmp

Filesize
4KB

Download
memory/3208-22-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3208-21-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3208-20-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3208-19-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3208-18-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3208-17-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3208-16-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3208-15-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3208-14-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3208-13-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/3208-12-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3208-11-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3208-10-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3208-9-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download
memory/3208-8-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/3208-7-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/3208-6-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/3208-5-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download
memory/3208-32-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/3208-31-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/3208-2-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/3208-4-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/3208-3-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/3208-64-0x00000000022A0000-0x00000000022F4000-memory.dmp

Filesize
336KB

Download
memory/3208-63-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/3792-66-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download