modiloader | 306b7c249e06e3198fccd72d2bda84de59387070f9315707d94628e25fcdcdeb

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-11-2024 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c925e7728c05012605ae9b606bb1680_JaffaCakes118.exe
Size

3.1MB
MD5

8c925e7728c05012605ae9b606bb1680
SHA1

a431757f1b68265dce504b8727b2a570cd8f8e78
SHA256

306b7c249e06e3198fccd72d2bda84de59387070f9315707d94628e25fcdcdeb
SHA512

126814bdeb361ae09202ab7142f11ab104d4ab1f92d0c6a312d895585efbcf7e9ba7730df8073901ca87572fbe9e33209b0b535b9c950c7f7dbf932170551dae
SSDEEP

24576:UL69HiIC60SNTze/bj8NYbVYnoXx8hgGb+HqTwX2CAHxF9v8ms3e:Ni80Stze/bjPYss7qcC8h9T

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2372-5-0x0000000000400000-0x00000000007B1000-memory.dmp	modiloader_stage2
behavioral1/memory/2372-6-0x0000000000400000-0x00000000007B1000-memory.dmp	modiloader_stage2
behavioral1/memory/2372-8-0x0000000000400000-0x00000000007B1000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

Processes:

8c925e7728c05012605ae9b606bb1680_JaffaCakes118.exe

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt	8c925e7728c05012605ae9b606bb1680_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

8c925e7728c05012605ae9b606bb1680_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8c925e7728c05012605ae9b606bb1680_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

8c925e7728c05012605ae9b606bb1680_JaffaCakes118.exe

pid	Process
2372	8c925e7728c05012605ae9b606bb1680_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8c925e7728c05012605ae9b606bb1680_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2372 wrote to memory of 1980	2372	8c925e7728c05012605ae9b606bb1680_JaffaCakes118.exe	30
PID 2372 wrote to memory of 1980	2372	8c925e7728c05012605ae9b606bb1680_JaffaCakes118.exe	30
PID 2372 wrote to memory of 1980	2372	8c925e7728c05012605ae9b606bb1680_JaffaCakes118.exe	30
PID 2372 wrote to memory of 1980	2372	8c925e7728c05012605ae9b606bb1680_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\8c925e7728c05012605ae9b606bb1680_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8c925e7728c05012605ae9b606bb1680_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2372-1-0x00000000002F0000-0x00000000003D7000-memory.dmp

Filesize
924KB

Download
memory/2372-0-0x0000000000400000-0x00000000007B1000-memory.dmp

Filesize
3.7MB

Download
memory/2372-2-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2372-5-0x0000000000400000-0x00000000007B1000-memory.dmp

Filesize
3.7MB

Download
memory/2372-7-0x0000000000401000-0x0000000000450000-memory.dmp

Filesize
316KB

Download
memory/2372-6-0x0000000000400000-0x00000000007B1000-memory.dmp

Filesize
3.7MB

Download
memory/2372-3-0x0000000000401000-0x0000000000450000-memory.dmp

Filesize
316KB

Download
memory/2372-8-0x0000000000400000-0x00000000007B1000-memory.dmp

Filesize
3.7MB

Download