modiloader | e8cb0ce834288db7ff7bedb91cb133373f7af9cadfee9a0aeab0f241a843b34f

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54100680913b7218b26d54d332b01934_JaffaCakes118.exe
Size

1.9MB
MD5

54100680913b7218b26d54d332b01934
SHA1

83caa1e6c28bdfa4f774e2dffb046d7471ec8ace
SHA256

e8cb0ce834288db7ff7bedb91cb133373f7af9cadfee9a0aeab0f241a843b34f
SHA512

6ad7a47eb1f074a567a85868d1b4ceb33b2c83eebc89d4df96451ae5ccc46d2bb0f122b1b77b0d962c86e0665024d92ba4de0c164df973bcdd9782b88abdfe1b
SSDEEP

49152:V09FxNqP3VbWXcZyb9IZ6PMhHh2WG5cI3K6VQQ5:SdqIsZyb9fP2HUWDP1Q5

Score

10^/10

modiloader discovery evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NETWORK.EXE

ModiLoader Second Stage 22 IoCs

resource	yara_rule
behavioral1/memory/2820-44-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-39-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-37-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-35-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-33-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-31-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-45-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-51-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-68-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-71-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-74-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-77-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-80-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-83-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-86-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-89-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-92-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-95-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-98-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-101-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-104-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2820-107-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2

Executes dropped EXE 3 IoCs

pid	Process
2900	WLSETUP-WEB.EXE
2800	NETWORK.EXE
2820	NETWORK.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\NETWORK.EXE"	NETWORK.EXE

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	NETWORK.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NETWORK.EXE

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2800-43-0x0000000000400000-0x00000000004A9000-memory.dmp	autoit_exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2648-16-0x0000000003A00000-0x0000000003AA9000-memory.dmp	upx
behavioral1/files/0x0008000000016b85-18.dat	upx
behavioral1/memory/2800-43-0x0000000000400000-0x00000000004A9000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CWLSETUP-WEB.EXE	54100680913b7218b26d54d332b01934_JaffaCakes118.exe
File created	C:\Windows\WLSETUP-WEB.EXE	54100680913b7218b26d54d332b01934_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54100680913b7218b26d54d332b01934_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WLSETUP-WEB.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETWORK.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETWORK.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2820	NETWORK.EXE
Token: SeDebugPrivilege	2820	NETWORK.EXE
Token: SeDebugPrivilege	2900	WLSETUP-WEB.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2820	NETWORK.EXE
2820	NETWORK.EXE

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2900	2648	54100680913b7218b26d54d332b01934_JaffaCakes118.exe	30
PID 2648 wrote to memory of 2900	2648	54100680913b7218b26d54d332b01934_JaffaCakes118.exe	30
PID 2648 wrote to memory of 2900	2648	54100680913b7218b26d54d332b01934_JaffaCakes118.exe	30
PID 2648 wrote to memory of 2900	2648	54100680913b7218b26d54d332b01934_JaffaCakes118.exe	30
PID 2648 wrote to memory of 2900	2648	54100680913b7218b26d54d332b01934_JaffaCakes118.exe	30
PID 2648 wrote to memory of 2900	2648	54100680913b7218b26d54d332b01934_JaffaCakes118.exe	30
PID 2648 wrote to memory of 2900	2648	54100680913b7218b26d54d332b01934_JaffaCakes118.exe	30
PID 2648 wrote to memory of 2800	2648	54100680913b7218b26d54d332b01934_JaffaCakes118.exe	31
PID 2648 wrote to memory of 2800	2648	54100680913b7218b26d54d332b01934_JaffaCakes118.exe	31
PID 2648 wrote to memory of 2800	2648	54100680913b7218b26d54d332b01934_JaffaCakes118.exe	31
PID 2648 wrote to memory of 2800	2648	54100680913b7218b26d54d332b01934_JaffaCakes118.exe	31
PID 2800 wrote to memory of 2820	2800	NETWORK.EXE	32
PID 2800 wrote to memory of 2820	2800	NETWORK.EXE	32
PID 2800 wrote to memory of 2820	2800	NETWORK.EXE	32
PID 2800 wrote to memory of 2820	2800	NETWORK.EXE	32
PID 2800 wrote to memory of 2820	2800	NETWORK.EXE	32
PID 2800 wrote to memory of 2820	2800	NETWORK.EXE	32
PID 2800 wrote to memory of 2820	2800	NETWORK.EXE	32
PID 2800 wrote to memory of 2820	2800	NETWORK.EXE	32
PID 2800 wrote to memory of 2820	2800	NETWORK.EXE	32
PID 2800 wrote to memory of 2820	2800	NETWORK.EXE	32
PID 2800 wrote to memory of 2820	2800	NETWORK.EXE	32

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NETWORK.EXE

C:\Users\Admin\AppData\Local\Temp\54100680913b7218b26d54d332b01934_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\54100680913b7218b26d54d332b01934_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\WLSETUP-WEB.EXE
  "C:\Windows\WLSETUP-WEB.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\NETWORK.EXE
  "C:\NETWORK.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\NETWORK.EXE
    "C:\NETWORK.EXE"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\NETWORK.EXE

Filesize
532KB

MD5
56d696dac985a514549780b2e0333f4d

SHA1
a9106ed2916e892d1ad50c15a9258583fe8ed04a

SHA256
007c5c3fd08b78da7237638375eedd42993cb516206226439f4a253a301bc7b7

SHA512
dcd5f2a498202c64668085deb99fc81e9c0b9783d7be2d4b8e30e0b4c435c04eeb1eebee85c65182a1f3483c48dc8061845cbbfe730e9c0525e299fc784f7be0

Download Submit
C:\Windows\WLSETUP-WEB.EXE

Filesize
1.2MB

MD5
a98a772ca74063ca136f5eebef8ce1a7

SHA1
38a933e28440af5930592c6ff03de4f77109ed97

SHA256
ec015a42049c41730d1dbdfa02268e0bea1698f39610da4f74058adffa7b5546

SHA512
553ee17ad1ff15897cb08359c6776e67f4129789b4667bd17b593cb31f1f40ec6f997ea27adc4c618684f9531c9a15306d1a5355b459d8480347ee3c80d979df

Download Submit
C:\cmsetac.dll

Filesize
33KB

MD5
4e1d9848139e02bc9459c33c543f2217

SHA1
346ca2e11efaf2cdd4c3cb1a8a5b56fd4a343d59

SHA256
4eee5030facd799af5e92a948ab7ab299f51d864696104f3f00b5a7bb89fa8f0

SHA512
272aff5956255fa3c6084abf6faf07196965feb54d01fc1e0bed7f0276854f216c70130ac0838efb1dbe5407abd5d0d8451922aafdeff9bc2fa0fdbdd3d9a8f6

Download Submit
memory/2648-0-0x0000000000400000-0x0000000000B17000-memory.dmp

Filesize
7.1MB

Download
memory/2648-2-0x0000000002540000-0x0000000002650000-memory.dmp

Filesize
1.1MB

Download
memory/2648-16-0x0000000003A00000-0x0000000003AA9000-memory.dmp

Filesize
676KB

Download
memory/2648-22-0x0000000003A00000-0x0000000003AA9000-memory.dmp

Filesize
676KB

Download
memory/2648-24-0x0000000000400000-0x0000000000B17000-memory.dmp

Filesize
7.1MB

Download
memory/2648-25-0x0000000002540000-0x0000000002650000-memory.dmp

Filesize
1.1MB

Download
memory/2800-26-0x0000000003D40000-0x0000000003DE9000-memory.dmp

Filesize
676KB

Download
memory/2800-43-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2820-51-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-69-0x0000000000170000-0x0000000000178000-memory.dmp

Filesize
32KB

Download
memory/2820-37-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-35-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-33-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-31-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-29-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-45-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-49-0x0000000000A40000-0x0000000000A4E000-memory.dmp

Filesize
56KB

Download
memory/2820-44-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-27-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-107-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-104-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-68-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-70-0x0000000000A40000-0x0000000000A4E000-memory.dmp

Filesize
56KB

Download
memory/2820-39-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-71-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-74-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-77-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-80-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-83-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-86-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-89-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-92-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-95-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-98-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2820-101-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2900-67-0x0000000000EB0000-0x0000000000EBE000-memory.dmp

Filesize
56KB

Download
memory/2900-66-0x0000000000EB0000-0x0000000000EBE000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads