modiloader | e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

906ac205366ee08598f28907939ae310_JaffaCakes118.exe
Size

348KB
MD5

906ac205366ee08598f28907939ae310
SHA1

a9af3927dcf8f5d6d3ccebfd721689c771bed311
SHA256

e2373a7541c1807e504c043158fbe94edad6ba6e0901c4a4f7142a27c7c77b27
SHA512

3a7dbb1984a0845b22e14383e4ac3573a503a136a65ea904c129c9f27632367fb64bc42190b81e2fa073cdfcf7696a36e90263b4fcba9d811b647d9cab1abbb1
SSDEEP

6144:VFjL41SWW+Yta+ySQ+GyoCZUdzlEOVciyGCE+riGDAGxZKcJv6Msx/BGbF:VFjs1SWpY/ySBVoCmdzlEqciy+yiGhZD

Score

10^/10

modiloader discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\Windows\\server.exe\""	server.exe

Modiloader family
modiloader

ModiLoader Second Stage 11 IoCs

resource	yara_rule
behavioral1/memory/2616-47-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/2616-48-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/2616-45-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/2616-43-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/2616-39-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/2616-37-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/2616-35-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/2616-33-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/2616-57-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/3028-86-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2
behavioral1/memory/3028-94-0x0000000000400000-0x000000000042C000-memory.dmp	modiloader_stage2

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05I41M56-QW07-U20F-YX8T-VB4U6TP4UX63}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{05I41M56-QW07-U20F-YX8T-VB4U6TP4UX63}\StubPath = "\"C:\\Windows\\server.exe\""	server.exe

Deletes itself 1 IoCs

pid	Process
2788	cmd.exe

Executes dropped EXE 5 IoCs

pid	Process
2900	fff2.exe
1584	J3qbFH8P8.exe
2616	J3qbFH8P8.exe
2496	server.exe
3028	server.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\server = "C:\\Windows\\server.exe"	server.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1584 set thread context of 2616	1584	J3qbFH8P8.exe	32
PID 2496 set thread context of 3028	2496	server.exe	34

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\server.exe	J3qbFH8P8.exe
File opened for modification	C:\Windows\server.exe	J3qbFH8P8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	906ac205366ee08598f28907939ae310_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fff2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	J3qbFH8P8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	J3qbFH8P8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2616	J3qbFH8P8.exe
3028	server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2900	fff2.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2232	906ac205366ee08598f28907939ae310_JaffaCakes118.exe
1584	J3qbFH8P8.exe
2496	server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2900	2232	906ac205366ee08598f28907939ae310_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2900	2232	906ac205366ee08598f28907939ae310_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2900	2232	906ac205366ee08598f28907939ae310_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2900	2232	906ac205366ee08598f28907939ae310_JaffaCakes118.exe	28
PID 2232 wrote to memory of 1584	2232	906ac205366ee08598f28907939ae310_JaffaCakes118.exe	29
PID 2232 wrote to memory of 1584	2232	906ac205366ee08598f28907939ae310_JaffaCakes118.exe	29
PID 2232 wrote to memory of 1584	2232	906ac205366ee08598f28907939ae310_JaffaCakes118.exe	29
PID 2232 wrote to memory of 1584	2232	906ac205366ee08598f28907939ae310_JaffaCakes118.exe	29
PID 2232 wrote to memory of 2788	2232	906ac205366ee08598f28907939ae310_JaffaCakes118.exe	30
PID 2232 wrote to memory of 2788	2232	906ac205366ee08598f28907939ae310_JaffaCakes118.exe	30
PID 2232 wrote to memory of 2788	2232	906ac205366ee08598f28907939ae310_JaffaCakes118.exe	30
PID 2232 wrote to memory of 2788	2232	906ac205366ee08598f28907939ae310_JaffaCakes118.exe	30
PID 1584 wrote to memory of 2616	1584	J3qbFH8P8.exe	32
PID 1584 wrote to memory of 2616	1584	J3qbFH8P8.exe	32
PID 1584 wrote to memory of 2616	1584	J3qbFH8P8.exe	32
PID 1584 wrote to memory of 2616	1584	J3qbFH8P8.exe	32
PID 1584 wrote to memory of 2616	1584	J3qbFH8P8.exe	32
PID 1584 wrote to memory of 2616	1584	J3qbFH8P8.exe	32
PID 1584 wrote to memory of 2616	1584	J3qbFH8P8.exe	32
PID 1584 wrote to memory of 2616	1584	J3qbFH8P8.exe	32
PID 1584 wrote to memory of 2616	1584	J3qbFH8P8.exe	32
PID 1584 wrote to memory of 2616	1584	J3qbFH8P8.exe	32
PID 1584 wrote to memory of 2616	1584	J3qbFH8P8.exe	32
PID 2616 wrote to memory of 2496	2616	J3qbFH8P8.exe	33
PID 2616 wrote to memory of 2496	2616	J3qbFH8P8.exe	33
PID 2616 wrote to memory of 2496	2616	J3qbFH8P8.exe	33
PID 2616 wrote to memory of 2496	2616	J3qbFH8P8.exe	33
PID 2496 wrote to memory of 3028	2496	server.exe	34
PID 2496 wrote to memory of 3028	2496	server.exe	34
PID 2496 wrote to memory of 3028	2496	server.exe	34
PID 2496 wrote to memory of 3028	2496	server.exe	34
PID 2496 wrote to memory of 3028	2496	server.exe	34
PID 2496 wrote to memory of 3028	2496	server.exe	34
PID 2496 wrote to memory of 3028	2496	server.exe	34
PID 2496 wrote to memory of 3028	2496	server.exe	34
PID 2496 wrote to memory of 3028	2496	server.exe	34
PID 2496 wrote to memory of 3028	2496	server.exe	34
PID 2496 wrote to memory of 3028	2496	server.exe	34
PID 2496 wrote to memory of 440	2496	server.exe	35
PID 2496 wrote to memory of 440	2496	server.exe	35
PID 2496 wrote to memory of 440	2496	server.exe	35
PID 2496 wrote to memory of 440	2496	server.exe	35
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37
PID 3028 wrote to memory of 1656	3028	server.exe	37

C:\Users\Admin\AppData\Local\Temp\906ac205366ee08598f28907939ae310_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\906ac205366ee08598f28907939ae310_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\fff2.exe
  "C:\fff2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2900
- C:\J3qbFH8P8.exe
  "C:\J3qbFH8P8.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\J3qbFH8P8.exe
    "C:\J3qbFH8P8.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Windows\server.exe
      "C:\Windows\server.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2496
    - - C:\Windows\server.exe
        
        "C:\Windows\server.exe"
        5⤵
        Modifies WinLogon for persistence
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3028
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:1656
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c \melt.bat
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:440
- C:\Windows\SysWOW64\cmd.exe
  cmd /c \melt.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\J3qbFH8P8.exe

Filesize
220KB

MD5
144dec755361311d15dce9b03d368d01

SHA1
4d331cb6d916d997ee0d14faa1ae8dded71b02c8

SHA256
98e284e33c2b8aaa654fe78b5586dbfd10c45b694415c9fe7718feeab4f4ca25

SHA512
d2fa423ca1dd8c6dac906ba640812686d6260120870b5878dcce00ef0d67229872eb6104d1e8caf043d9d8a38d28699c2b491d271f1d16839d631f9102130993

Download Submit
C:\fff2.exe

Filesize
54KB

MD5
116d27fdf50ebecaada14096812dbf90

SHA1
5af91f4129b2e38f8decd50c8b0cc5d09c042bf1

SHA256
3ed5f41bad3acaf3eb8507d61b70c75c84e18febe06ebd482f3c366edcec394c

SHA512
e98eb844f4ddf74cccab1a14ea1a03accc3c2e0daa02aeb32d4718dbbb547ba80dbcd0d8469aed4d0f4fbb6949ddfe5e70fff099651d69d9fe8d2047b54b7c2a

Download Submit
C:\melt.bat

Filesize
249B

MD5
78760debe420c80996552877e238d384

SHA1
bf7bd68b5f33daebc3545b48c0cbeeaaf159bb6a

SHA256
b9823f6fca3bd54fd4727b4c9dda191115b6cfcdc8e4a39b039473682a6ab8dc

SHA512
ad0d5ab9a7a912c1fab0a74226ab75d06cd939b67198a0d259b37bb5e6a8e80b87749e9ad829e162bc5c30c67fee60c3ba3a1cc9372b1726691b742cb9219317

Download Submit
C:\melt.bat

Filesize
123B

MD5
58a67e1781a193dcf2f9f0685426380d

SHA1
8ce90e1df11d529112abb400b930dcfc73d78fce

SHA256
229cfb10926e706af01042a8348a9a910cfad0cb0aa9bc20c65e8dec0f006136

SHA512
598349435ac6abe93fab69891f33a7cb2c1d47184398c867eed8b057ee9b045e20865e79a839762f465a27c05efdd21d30caa1dc262c03321804513eef66e05a

Download Submit
memory/2232-9-0x0000000002520000-0x0000000002559000-memory.dmp

Filesize
228KB

Download
memory/2232-8-0x0000000002520000-0x0000000002559000-memory.dmp

Filesize
228KB

Download
memory/2616-39-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2616-33-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2616-47-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2616-45-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2616-43-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2616-41-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2616-31-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2616-37-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2616-35-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2616-48-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2616-29-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2616-57-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2900-14-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2900-97-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3028-87-0x0000000010410000-0x0000000010455000-memory.dmp

Filesize
276KB

Download
memory/3028-86-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3028-94-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3028-88-0x0000000010410000-0x0000000010455000-memory.dmp

Filesize
276KB

Download