modiloader | 0e28de626095d71a93bcf931abf1937793369e8ee3b883d8721710f148e63f96

Analysis

max time kernel
91s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03-11-2024 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe
Size

501KB
MD5

8dfe31b32fe7101633f79cca2f1e39d4
SHA1

8feb727952f773c5e9d27b3884dd617c12846164
SHA256

0e28de626095d71a93bcf931abf1937793369e8ee3b883d8721710f148e63f96
SHA512

d1a7cb27147422dd85c7eb1a897dbbae2b9b355d53381d18b8a65352ba591e03eebbfb7429b9bd2b46edd4fa26bde536acc2c1a5cb0167d5a9eeb44f805af144
SSDEEP

12288:JJBu0QgQ7pO6aPhUJIDhb5QVsF3Z4mxx4Nrv4vEFBpu7SwmCPhb4Nx:JXsgyO6aKcQmX4Nrv4MVu7lmCh4r

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1900-91-0x0000000000400000-0x000000000050E000-memory.dmp	modiloader_stage2
behavioral1/memory/1900-87-0x0000000004230000-0x000000000433E000-memory.dmp	modiloader_stage2
behavioral1/memory/3008-79-0x0000000000400000-0x000000000050E000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
2900	cmd.exe

Executes dropped EXE 1 IoCs

Processes:

ClipBookk.exe

pid	Process
3008	ClipBookk.exe

Loads dropped DLL 2 IoCs

Processes:

8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe

pid	Process
1900	8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe
1900	8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

Processes:

8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exeClipBookk.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ClipBookk.exe	8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ClipBookk.exe	ClipBookk.exe
File created	C:\Windows\SysWOW64\Deleteme.bat	8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ClipBookk.exe	8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exeClipBookk.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClipBookk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe

description	pid	Process	procid_target
PID 1900 wrote to memory of 3008	1900	8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe	30
PID 1900 wrote to memory of 3008	1900	8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe	30
PID 1900 wrote to memory of 3008	1900	8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe	30
PID 1900 wrote to memory of 3008	1900	8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe	30
PID 1900 wrote to memory of 2900	1900	8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe	31
PID 1900 wrote to memory of 2900	1900	8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe	31
PID 1900 wrote to memory of 2900	1900	8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe	31
PID 1900 wrote to memory of 2900	1900	8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8dfe31b32fe7101633f79cca2f1e39d4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\ClipBookk.exe
  C:\Windows\system32\ClipBookk.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:3008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\Deleteme.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ClipBookk.exe

Filesize
501KB

MD5
8dfe31b32fe7101633f79cca2f1e39d4

SHA1
8feb727952f773c5e9d27b3884dd617c12846164

SHA256
0e28de626095d71a93bcf931abf1937793369e8ee3b883d8721710f148e63f96

SHA512
d1a7cb27147422dd85c7eb1a897dbbae2b9b355d53381d18b8a65352ba591e03eebbfb7429b9bd2b46edd4fa26bde536acc2c1a5cb0167d5a9eeb44f805af144

Download Submit
C:\Windows\SysWOW64\Deleteme.bat

Filesize
212B

MD5
3128b3104e67f0ceb5c29060916a7c36

SHA1
4327985f894e769402bc30ad4f1b489e3c4a218a

SHA256
f005fb0cba9716bd3ce318a87cda84dc68f7b7236bd536c58d3f6deaff84ffd2

SHA512
3f592f89470ac0f092056e7cb486628a5645d074c792a412d8634b44adf75bf5a2752516f984e0c3c0eda567ea7fceb136615d4b01a5194d2122ff3c5e7400f3

Download Submit
memory/1900-1-0x00000000005E0000-0x0000000000634000-memory.dmp

Filesize
336KB

Download
memory/1900-0-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/1900-2-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

Filesize
4KB

Download
memory/1900-3-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/1900-13-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-10-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/1900-9-0x0000000001EE0000-0x0000000001EE1000-memory.dmp

Filesize
4KB

Download
memory/1900-8-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

Filesize
4KB

Download
memory/1900-7-0x0000000001EC0000-0x0000000001EC1000-memory.dmp

Filesize
4KB

Download
memory/1900-6-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/1900-5-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1900-4-0x0000000001ED0000-0x0000000001ED1000-memory.dmp

Filesize
4KB

Download
memory/1900-17-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-16-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-15-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-14-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-18-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-19-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-20-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-21-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-22-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-23-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-24-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-25-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-26-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-27-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-29-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-28-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-30-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-33-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-32-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-31-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-36-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-38-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-49-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-69-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1900-68-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-67-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-66-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-65-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-64-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-63-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-91-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/1900-90-0x00000000005E0000-0x0000000000634000-memory.dmp

Filesize
336KB

Download
memory/1900-87-0x0000000004230000-0x000000000433E000-memory.dmp

Filesize
1.1MB

Download
memory/1900-88-0x0000000004230000-0x000000000433E000-memory.dmp

Filesize
1.1MB

Download
memory/1900-62-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-61-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-60-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-59-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-58-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-57-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-56-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-55-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-54-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-53-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-52-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-48-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-47-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-51-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-46-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-45-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-44-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-43-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-50-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-42-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-41-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-40-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-39-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-35-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-34-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/1900-37-0x0000000003220000-0x0000000003320000-memory.dmp

Filesize
1024KB

Download
memory/3008-79-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download