modiloader | ac77946697a45237430e31197ede6ab060e713d9b4136113bad5cd830c4e82dd

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2024, 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe
Size

21KB
MD5

a44d554e1c636a8d6bfdb9694e6f0c7a
SHA1

2364b44376c0ad63615c763664951e665c18020a
SHA256

ac77946697a45237430e31197ede6ab060e713d9b4136113bad5cd830c4e82dd
SHA512

3716fb3ca3b706aea0486bc238345fbe9f1b73514dcc6bbf1a98f3ddcd37e3719d06aabfe98af2fc1dfb07902c801727631f8b431717ec988806b5214ecf990b
SSDEEP

384:nJEunqcFxpLszA1JUrPSNLg13uD8V9+Vwpa0gU:CunqAxpLszA1+SRgY8VEV907

Score

10^/10

modiloader discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/2076-8-0x0000000000400000-0x000000000040C000-memory.dmp	modiloader_stage2

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\what? = "C:\\Windows\\system32\\a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe"	a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\file.txt	a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Wincfg.bat	a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe	a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe	a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 5108	2076	a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe	88
PID 2076 wrote to memory of 5108	2076	a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe	88
PID 2076 wrote to memory of 5108	2076	a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe	88
PID 5108 wrote to memory of 1520	5108	cmd.exe	91
PID 5108 wrote to memory of 1520	5108	cmd.exe	91
PID 5108 wrote to memory of 1520	5108	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a44d554e1c636a8d6bfdb9694e6f0c7a_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Wincfg.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" TYPE NUL "
    3⤵
    PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Wincfg.bat

Filesize
166B

MD5
2dcf35a693285eb44dcc6c79d1b4a6df

SHA1
64cba6f7a666e44d5cf43cde11b128d6846f88e6

SHA256
733fd5e27ec732b399399ef169acbd5ac9e977397192afaa41c25f327ee1bf32

SHA512
aa06697a7ba423aa243667f70e1156fddccd5cda18c1e48e03f7aef25637130353eb84cec679729cf04eb68f67e8383cb8043449beb7cc1300ef62f8fa70b2b4

Download Submit
C:\Windows\SysWOW64\file.txt

Filesize
301B

MD5
cd76df145787bb1da4e38d1a7b4a046b

SHA1
b6c000b8e7f7a85c40bb3e4beed83b948fc0f4b1

SHA256
8630feadcd7858add8b4441f55d15bfc657de16e4e629c04f258de0ce51f59cf

SHA512
66209e253c080604971056b7e7dc90e7bd3faff3851a5768c1c30ad042db6c7f5e7adbd5c94a6561dd5a69895fec30cdba8309d06c61fcc1c1df1d26fb73b5ac

Download Submit
memory/2076-8-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads