modiloader | a753ca8a96661afa4384fd5ca6f6ffea6eaa805aefdcb8d65c1dc60e453bf9c9

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2024 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

015daf3cac6e0f475af09decb9215ede_JaffaCakes118.exe
Size

691KB
MD5

015daf3cac6e0f475af09decb9215ede
SHA1

4ae4af1e1a307ba235c6223b0ed1baf057dd43e2
SHA256

a753ca8a96661afa4384fd5ca6f6ffea6eaa805aefdcb8d65c1dc60e453bf9c9
SHA512

580985a513c2b9a972b57ef86c412a0a545789532b0f95865d12851858f867ecbd29136701e2d6857deb220f7c07b36b4c34d7ad3a97b92b8e0add1a50db6e46
SSDEEP

12288:KERVq31AQHW3W4KlqckjwfIVLUI7f2wx/hCzJji6KTZ6+33TMHZVh:r3qeG4KUchcz2PRm6Q3TM5Vh

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/2428-2-0x0000000000400000-0x00000000004BF000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\2010.txt	015daf3cac6e0f475af09decb9215ede_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	015daf3cac6e0f475af09decb9215ede_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 3288	2428	015daf3cac6e0f475af09decb9215ede_JaffaCakes118.exe	82
PID 2428 wrote to memory of 3288	2428	015daf3cac6e0f475af09decb9215ede_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\015daf3cac6e0f475af09decb9215ede_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\015daf3cac6e0f475af09decb9215ede_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2428-0-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/2428-2-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download