modiloader | 0631919250c0213e9c2d9b11d6c23f86984159c47c31625e183f43eea6b39f90

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2024 16:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
Size

754KB
MD5

867092596904a7a789080c05e327b1f5
SHA1

d9c92a5d40af0dce43ba3427060b448e7296f7d1
SHA256

0631919250c0213e9c2d9b11d6c23f86984159c47c31625e183f43eea6b39f90
SHA512

46a2c3f0d7e80069416a50c06b6749d89c3369d4085bcff6a9345b1f1c7bcbcd24c7aa933dcd82ad8cd5bfbee8e94e0265978b40f9f89f228c8e119ed583c6c7
SSDEEP

12288:iJ1fm4weQtqAyniHImjS0V8IynFKqLJ031bF3Z4mxxyTSb56YH8W:+tqkAyncImnKnF1V031bQmXZ16YH

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4008-35-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/4008-38-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/116-63-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/4008-65-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/116-56-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2
behavioral2/memory/4008-52-0x0000000000400000-0x0000000000555000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

re101.exe

pid	Process
116	re101.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

867092596904a7a789080c05e327b1f5_JaffaCakes118.exe

description	ioc	Process
File opened (read-only)	\??\B:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\Q:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\W:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\J:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\K:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\R:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\S:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\T:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\A:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\E:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\H:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\V:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\Y:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\Z:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\I:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\U:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\N:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\O:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\P:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\X:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\G:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\L:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened (read-only)	\??\M:	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

867092596904a7a789080c05e327b1f5_JaffaCakes118.exe

description	ioc	Process
File created	C:\AutoRun.inf	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened for modification	C:\AutoRun.inf	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File created	F:\AutoRun.inf	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened for modification	F:\AutoRun.inf	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

Processes:

re101.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\_re101.exe	re101.exe
File opened for modification	C:\Windows\SysWOW64\_re101.exe	re101.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

re101.exe

description	pid	Process	procid_target
PID 116 set thread context of 4316	116	re101.exe	88

Drops file in Program Files directory 3 IoCs

Processes:

867092596904a7a789080c05e327b1f5_JaffaCakes118.exe

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\re101.exe	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\re101.exe	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2492	4316	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

867092596904a7a789080c05e327b1f5_JaffaCakes118.exere101.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	re101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

867092596904a7a789080c05e327b1f5_JaffaCakes118.exere101.exe

description	pid	Process	procid_target
PID 4008 wrote to memory of 116	4008	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe	87
PID 4008 wrote to memory of 116	4008	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe	87
PID 4008 wrote to memory of 116	4008	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe	87
PID 116 wrote to memory of 4316	116	re101.exe	88
PID 116 wrote to memory of 4316	116	re101.exe	88
PID 116 wrote to memory of 4316	116	re101.exe	88
PID 116 wrote to memory of 4316	116	re101.exe	88
PID 116 wrote to memory of 4316	116	re101.exe	88
PID 4008 wrote to memory of 764	4008	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe	90
PID 4008 wrote to memory of 764	4008	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe	90
PID 4008 wrote to memory of 764	4008	867092596904a7a789080c05e327b1f5_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\867092596904a7a789080c05e327b1f5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\867092596904a7a789080c05e327b1f5_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\re101.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\re101.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:4316
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 12
      4⤵
      Program crash
      PID:2492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4316 -ip 4316
1⤵
PID:4492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat

Filesize
212B

MD5
cafccb5eec5213be999230109f3bf5be

SHA1
47fd206b5fdba9341b052bac3ea97278ddec443a

SHA256
7973e98b7a4fcc5fed8c7c6cc471695831b5d96c18faed26c116724e10656547

SHA512
e1ed8b1ed317fc989e63ac4eea79f9973c346c574edca060bfd2fd2c58c1172e1275801a013d0c505d88fc82f34650aebfba5762768031af66bc21e360ee3a3f

Download Submit
F:\re101.exe

Filesize
754KB

MD5
867092596904a7a789080c05e327b1f5

SHA1
d9c92a5d40af0dce43ba3427060b448e7296f7d1

SHA256
0631919250c0213e9c2d9b11d6c23f86984159c47c31625e183f43eea6b39f90

SHA512
46a2c3f0d7e80069416a50c06b6749d89c3369d4085bcff6a9345b1f1c7bcbcd24c7aa933dcd82ad8cd5bfbee8e94e0265978b40f9f89f228c8e119ed583c6c7

Download Submit
memory/116-56-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/116-63-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/116-55-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/116-54-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/4008-23-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4008-30-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/4008-27-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4008-26-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4008-25-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4008-24-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4008-0-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/4008-22-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4008-21-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4008-38-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/4008-37-0x00000000004CF000-0x00000000004D0000-memory.dmp

Filesize
4KB

Download
memory/4008-20-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4008-19-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4008-18-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/4008-17-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/4008-16-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/4008-15-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/4008-14-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/4008-29-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4008-13-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/4008-33-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4008-28-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/4008-31-0x00000000033E0000-0x00000000033E1000-memory.dmp

Filesize
4KB

Download
memory/4008-12-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/4008-11-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/4008-10-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/4008-9-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4008-8-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4008-7-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/4008-6-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/4008-5-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/4008-4-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/4008-3-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/4008-2-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/4008-35-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/4008-53-0x00000000021C0000-0x0000000002214000-memory.dmp

Filesize
336KB

Download
memory/4008-34-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4008-36-0x0000000003420000-0x0000000003421000-memory.dmp

Filesize
4KB

Download
memory/4008-65-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/4008-32-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/4008-52-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/4008-1-0x00000000021C0000-0x0000000002214000-memory.dmp

Filesize
336KB

Download