modiloader | 0622f3263f8dd3cc34d26a799afc18f11f856eae0be01f1cc8c356ce1ada1485

Analysis

max time kernel
95s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2024, 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b44f092230e90b5c46e45c2e7c5b9f4b_JaffaCakes118.exe
Size

36KB
MD5

b44f092230e90b5c46e45c2e7c5b9f4b
SHA1

68d674d8d864cde27e4d8a675ffa4e1253be2178
SHA256

0622f3263f8dd3cc34d26a799afc18f11f856eae0be01f1cc8c356ce1ada1485
SHA512

3b0e2f510070140a7dcba67be7f510e3df041c7215a605b469f3127869858ae815aa8578328498ab265d614b3bbe3d2017d3ea6fe90f8bafb2fc7717bf66dbff
SSDEEP

768:zd21oFPFeODD4ieeurvidJIz4EGMgoY+go8qXx+dCz:zd2SPZ4BeJIEERC7Cz

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/2988-13-0x00000000005A0000-0x00000000005C4000-memory.dmp	modiloader_stage2

Loads dropped DLL 2 IoCs

pid	Process
2988	b44f092230e90b5c46e45c2e7c5b9f4b_JaffaCakes118.exe
2988	b44f092230e90b5c46e45c2e7c5b9f4b_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\atmQQ2.dll	b44f092230e90b5c46e45c2e7c5b9f4b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b44f092230e90b5c46e45c2e7c5b9f4b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2988	b44f092230e90b5c46e45c2e7c5b9f4b_JaffaCakes118.exe
2988	b44f092230e90b5c46e45c2e7c5b9f4b_JaffaCakes118.exe
2988	b44f092230e90b5c46e45c2e7c5b9f4b_JaffaCakes118.exe
2988	b44f092230e90b5c46e45c2e7c5b9f4b_JaffaCakes118.exe
2988	b44f092230e90b5c46e45c2e7c5b9f4b_JaffaCakes118.exe
2988	b44f092230e90b5c46e45c2e7c5b9f4b_JaffaCakes118.exe
2988	b44f092230e90b5c46e45c2e7c5b9f4b_JaffaCakes118.exe
2988	b44f092230e90b5c46e45c2e7c5b9f4b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2988	b44f092230e90b5c46e45c2e7c5b9f4b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b44f092230e90b5c46e45c2e7c5b9f4b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b44f092230e90b5c46e45c2e7c5b9f4b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\MSInfo\atmQQ2.dll

Filesize
21KB

MD5
c500a7337dcd278431a8e0d9fe179159

SHA1
44292e95400a3b83deb114480b745efc782fe6cc

SHA256
b8e992c875e0466236a3492e2185b9a118333b5f0588c0ce7a7ea72b8fe156cb

SHA512
5d62d47daf8182ba685588bfa34d54da7a6e8328e47c9ac425d82c735240df576daf329695d54bc5d253d5bfc7d2341e4ba186d49aaa35b4c34c3ab3e854c358

Download Submit
memory/2988-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2988-1-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2988-2-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2988-8-0x00000000005A0000-0x00000000005C4000-memory.dmp

Filesize
144KB

Download
memory/2988-10-0x00000000005A0000-0x00000000005C4000-memory.dmp

Filesize
144KB

Download
memory/2988-11-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2988-12-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2988-13-0x00000000005A0000-0x00000000005C4000-memory.dmp

Filesize
144KB

Download