modiloader | e12736311cbfb948e0391b2c62fd592fdfae4f67f32a369572a32839d042ad3f

Analysis

max time kernel
93s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

909d92dc5047aeb0e62ec8cc846e46f2_JaffaCakes118.exe
Size

35KB
MD5

909d92dc5047aeb0e62ec8cc846e46f2
SHA1

81af0165d7449f0b7f5498f23759314ce3f34d32
SHA256

e12736311cbfb948e0391b2c62fd592fdfae4f67f32a369572a32839d042ad3f
SHA512

6de01832e43296c3e407b1d2f01c967224c8db57be00391922c226488c2af60ca1483e906228aafafd68662f4b0950e084475baf7b158af7e941a50559a40a1c
SSDEEP

768:7G2/BoDP0hUDn5+tnEqo4LfUBcQTyIh7SZSVcIFZ9M3N5KT3A:7G2/0P0hUD5sc8GcQd7SZ/2Z9M3H5

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/4016-10-0x0000000000880000-0x00000000008A3000-memory.dmp	modiloader_stage2
behavioral2/memory/4016-13-0x0000000000880000-0x00000000008A3000-memory.dmp	modiloader_stage2

Loads dropped DLL 2 IoCs

pid	Process
4016	909d92dc5047aeb0e62ec8cc846e46f2_JaffaCakes118.exe
4016	909d92dc5047aeb0e62ec8cc846e46f2_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\atmQQ2.dll	909d92dc5047aeb0e62ec8cc846e46f2_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	909d92dc5047aeb0e62ec8cc846e46f2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4016	909d92dc5047aeb0e62ec8cc846e46f2_JaffaCakes118.exe
4016	909d92dc5047aeb0e62ec8cc846e46f2_JaffaCakes118.exe
4016	909d92dc5047aeb0e62ec8cc846e46f2_JaffaCakes118.exe
4016	909d92dc5047aeb0e62ec8cc846e46f2_JaffaCakes118.exe
4016	909d92dc5047aeb0e62ec8cc846e46f2_JaffaCakes118.exe
4016	909d92dc5047aeb0e62ec8cc846e46f2_JaffaCakes118.exe
4016	909d92dc5047aeb0e62ec8cc846e46f2_JaffaCakes118.exe
4016	909d92dc5047aeb0e62ec8cc846e46f2_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4016	909d92dc5047aeb0e62ec8cc846e46f2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\909d92dc5047aeb0e62ec8cc846e46f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\909d92dc5047aeb0e62ec8cc846e46f2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\MSInfo\atmQQ2.dll

Filesize
20KB

MD5
46d1cecd5732b76981dd919a864df0c2

SHA1
d3a22af98aa5ca01767736ae94aae075b12dae48

SHA256
bb50c05be0b1eda44b1a078ad3029cc95ec4bf0ae82a5f08ce4dc6db12430de1

SHA512
ab4f7b9f3030342083f87a9e19a38cd0801892e7152f7450b8e95e0f83eb0261fd0a1845b9adc34dc5de21c1b31663d52a739523844aef2a6bd885b7613c76d6

Download Submit
memory/4016-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4016-2-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/4016-1-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4016-9-0x0000000000880000-0x00000000008A3000-memory.dmp

Filesize
140KB

Download
memory/4016-10-0x0000000000880000-0x00000000008A3000-memory.dmp

Filesize
140KB

Download
memory/4016-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4016-12-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/4016-13-0x0000000000880000-0x00000000008A3000-memory.dmp

Filesize
140KB

Download