modiloader | ac77946697a45237430e31197ede6ab060e713d9b4136113bad5cd830c4e82dd

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26/11/2024, 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe
Size

21KB
MD5

a44d554e1c636a8d6bfdb9694e6f0c7a
SHA1

2364b44376c0ad63615c763664951e665c18020a
SHA256

ac77946697a45237430e31197ede6ab060e713d9b4136113bad5cd830c4e82dd
SHA512

3716fb3ca3b706aea0486bc238345fbe9f1b73514dcc6bbf1a98f3ddcd37e3719d06aabfe98af2fc1dfb07902c801727631f8b431717ec988806b5214ecf990b
SSDEEP

384:nJEunqcFxpLszA1JUrPSNLg13uD8V9+Vwpa0gU:CunqAxpLszA1+SRgY8VEV907

Score

10^/10

modiloader discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2204-13-0x0000000000400000-0x000000000040C000-memory.dmp	modiloader_stage2

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\what? = "C:\\Windows\\system32\\a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe"	a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe	a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe	a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\file.txt	a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Wincfg.bat	a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2944	2204	a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe	29
PID 2204 wrote to memory of 2944	2204	a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe	29
PID 2204 wrote to memory of 2944	2204	a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe	29
PID 2204 wrote to memory of 2944	2204	a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe	29
PID 2944 wrote to memory of 2420	2944	cmd.exe	31
PID 2944 wrote to memory of 2420	2944	cmd.exe	31
PID 2944 wrote to memory of 2420	2944	cmd.exe	31
PID 2944 wrote to memory of 2420	2944	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\Wincfg.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" TYPE NUL "
    3⤵
    PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Wincfg.bat

Filesize
166B

MD5
2dcf35a693285eb44dcc6c79d1b4a6df

SHA1
64cba6f7a666e44d5cf43cde11b128d6846f88e6

SHA256
733fd5e27ec732b399399ef169acbd5ac9e977397192afaa41c25f327ee1bf32

SHA512
aa06697a7ba423aa243667f70e1156fddccd5cda18c1e48e03f7aef25637130353eb84cec679729cf04eb68f67e8383cb8043449beb7cc1300ef62f8fa70b2b4

Download Submit
C:\Windows\SysWOW64\file.txt

Filesize
57KB

MD5
4b961df88485df36ca81199e7095a622

SHA1
644685afce4280a689f6b2e155531257fa334061

SHA256
b0e06592f1187bf524ed30e96572c4ef03d8cefc2dd32bc593d7e5825b76eaad

SHA512
e89df407bd336bc9b7b02fd4f4349f003bb7ac93727596619cce296e5c071ce6e0a5fab9b13b2cf5a1a03edf9480593967973e0654e27d74d30e045a1f28e443

Download Submit
memory/2204-13-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads