modiloader | 731061a508b524752e9b6c604d492be9968381e73de82d1cdc13bca03fb71de4

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-10-2024 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe
Size

262KB
MD5

821319717999213f816bcdea1fb4c3ee
SHA1

ffe8d10d415d82bbfe9353d6cd7cec9249326689
SHA256

731061a508b524752e9b6c604d492be9968381e73de82d1cdc13bca03fb71de4
SHA512

99fbc1f3ab9dd12bcdb62c251b7177d24aad345781b173f44818b636db61ca364997141f371c4e38b16b0bb92c8e3552397eadafadf14ad90884c0c5a13a5f4e
SSDEEP

6144:Xq2RPYOaO7IBjSab3jyFPIXzhZQfjsmZEISY8r:aaPYOagIBmc3uqFGBEIT8r

Score

10^/10

modiloader discovery evasion trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe

ModiLoader Second Stage 23 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3044-34-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-33-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-35-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-37-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-45-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-46-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-47-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-48-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-49-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-50-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-51-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-54-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-55-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-58-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-61-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-64-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-67-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-70-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-73-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-76-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-79-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-82-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral1/memory/3044-85-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2

Loads dropped DLL 2 IoCs

Processes:

821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe

pid	Process
3044	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe
3044	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe

description	pid	Process	procid_target
PID 1924 set thread context of 2060	1924	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe	30
PID 2060 set thread context of 3044	2060	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe	31

UPX packed file 35 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2060-5-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2060-11-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2060-14-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2060-7-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2060-15-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3044-20-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/2060-30-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/3044-27-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-25-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-22-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-31-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-32-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-34-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-33-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-35-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-37-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-45-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-46-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-47-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-48-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-49-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-50-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-51-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-54-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-55-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-58-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-61-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-64-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-67-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-70-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-73-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-76-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-79-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-82-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3044-85-0x0000000000400000-0x000000000044F000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

Processes:

821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe

description	ioc	Process
File created	C:\Windows\VMPipe32.dll	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe

description	pid	Process
Token: SeDebugPrivilege	3044	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe
Token: SeDebugPrivilege	3044	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe

pid	Process
1924	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe
2060	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe
3044	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe
3044	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe

description	pid	Process	procid_target
PID 1924 wrote to memory of 2060	1924	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe	30
PID 1924 wrote to memory of 2060	1924	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe	30
PID 1924 wrote to memory of 2060	1924	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe	30
PID 1924 wrote to memory of 2060	1924	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe	30
PID 1924 wrote to memory of 2060	1924	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe	30
PID 1924 wrote to memory of 2060	1924	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe	30
PID 1924 wrote to memory of 2060	1924	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe	30
PID 1924 wrote to memory of 2060	1924	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe	30
PID 2060 wrote to memory of 3044	2060	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe	31
PID 2060 wrote to memory of 3044	2060	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe	31
PID 2060 wrote to memory of 3044	2060	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe	31
PID 2060 wrote to memory of 3044	2060	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe	31
PID 2060 wrote to memory of 3044	2060	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe	31
PID 2060 wrote to memory of 3044	2060	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe	31
PID 2060 wrote to memory of 3044	2060	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe	31
PID 2060 wrote to memory of 3044	2060	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe	31

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Local\Temp\821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Users\Admin\AppData\Local\Temp\821319717999213f816bcdea1fb4c3ee_JaffaCakes118.exe
    3⤵
    - UAC bypass
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\cmsetac.dll

Filesize
32KB

MD5
a692f8468026b94c2b39ed7d93a4d2b9

SHA1
e3170d68f5d85918fbf3d1788e6fabf88ad85952

SHA256
b8daaca9165aee57f4b803a12a970043bfe7ea0889ab64fd1a08981ae8869d7b

SHA512
4f736d7283ec16c58ae936236abb57068f0aafa850a49a73ae1f5e314b9db6b113c311f67540add4fa2cb2f78ff5034de18a0b045196babd7446a3489e31ddd5

Download Submit
\Users\Admin\AppData\Local\Temp\ntdtcstp.dll

Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
memory/1924-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2060-3-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2060-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2060-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2060-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2060-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2060-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2060-15-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2060-30-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3044-27-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-50-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-22-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-31-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-32-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-34-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-33-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-35-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-37-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-20-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-43-0x0000000002430000-0x000000000243E000-memory.dmp

Filesize
56KB

Download
memory/3044-18-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-45-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-46-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-47-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-48-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-49-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-25-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-51-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-52-0x0000000000510000-0x0000000000518000-memory.dmp

Filesize
32KB

Download
memory/3044-53-0x0000000002430000-0x000000000243E000-memory.dmp

Filesize
56KB

Download
memory/3044-54-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-55-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-58-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-61-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-64-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-67-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-70-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-73-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-76-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-79-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-82-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3044-85-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download