modiloader | d7faead97e5eaeb26d21a2ac323d1b3d4e71588598a4e92f519500de36c23bef

Analysis

max time kernel
93s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2024 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95f31ff993bae4f21ae09c0e125a280e_JaffaCakes118.exe
Size

36KB
MD5

95f31ff993bae4f21ae09c0e125a280e
SHA1

f98f63955731c0030c7adf5b3d3a19d133c1f7c2
SHA256

d7faead97e5eaeb26d21a2ac323d1b3d4e71588598a4e92f519500de36c23bef
SHA512

8701501f49aa6a934b7d8874e67da0f968783c6d6a22efbf71687a09d11c33df13fcba9bd363b6979fba72852d1263e61c1f63874e40fd60697af9f0273cc2ef
SSDEEP

768:i12QAp628zKGIxxfKECu33C2N37StWSv7/o3NxwhayQ:i12QAp3MKGITfK9/24tvk9xKQ

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/2912-9-0x00000000005C0000-0x00000000005E4000-memory.dmp	modiloader_stage2
behavioral2/memory/2912-12-0x00000000005C0000-0x00000000005E4000-memory.dmp	modiloader_stage2

Loads dropped DLL 2 IoCs

pid	Process
2912	95f31ff993bae4f21ae09c0e125a280e_JaffaCakes118.exe
2912	95f31ff993bae4f21ae09c0e125a280e_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\atmQQ2.dll	95f31ff993bae4f21ae09c0e125a280e_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95f31ff993bae4f21ae09c0e125a280e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2912	95f31ff993bae4f21ae09c0e125a280e_JaffaCakes118.exe
2912	95f31ff993bae4f21ae09c0e125a280e_JaffaCakes118.exe
2912	95f31ff993bae4f21ae09c0e125a280e_JaffaCakes118.exe
2912	95f31ff993bae4f21ae09c0e125a280e_JaffaCakes118.exe
2912	95f31ff993bae4f21ae09c0e125a280e_JaffaCakes118.exe
2912	95f31ff993bae4f21ae09c0e125a280e_JaffaCakes118.exe
2912	95f31ff993bae4f21ae09c0e125a280e_JaffaCakes118.exe
2912	95f31ff993bae4f21ae09c0e125a280e_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2912	95f31ff993bae4f21ae09c0e125a280e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\95f31ff993bae4f21ae09c0e125a280e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\95f31ff993bae4f21ae09c0e125a280e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\MSInfo\atmQQ2.dll

Filesize
20KB

MD5
4d2c3e8101cecf97f3ddf40f18fdb5f3

SHA1
96b872d6d7529f276dc18d2945fe57c9c107dea5

SHA256
12b9265049deea1c139c3cbcdfc37680a46f560c57e602ef646f59fb7c62ea2d

SHA512
c6d3751ae463f1b1b3677d319888721d32ec9bf478bd9443fe42093be5ee3ec84d33150f2eb60a55ec88ab09879c4d04d8d8a22925bc7a980304c4c1587bd3a7

Download Submit
memory/2912-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2912-1-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2912-2-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2912-9-0x00000000005C0000-0x00000000005E4000-memory.dmp

Filesize
144KB

Download
memory/2912-10-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2912-11-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2912-12-0x00000000005C0000-0x00000000005E4000-memory.dmp

Filesize
144KB

Download