modiloader | f46789bdcd33bd5e9d3c6a1823d4f3584ac08ba2ee5b583c8c4fba5c69291f45

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbc9ddb662532c71ba27c24970ed70c1_JaffaCakes118.exe
Size

163KB
MD5

dbc9ddb662532c71ba27c24970ed70c1
SHA1

ddf78fd0b35cf9bd24100832e5b68833b2a99dc7
SHA256

f46789bdcd33bd5e9d3c6a1823d4f3584ac08ba2ee5b583c8c4fba5c69291f45
SHA512

8e8723804d78f53f29602678f8f542020916d2c1092c76dd128f9a12604ac20a9157f02ef8c9bd70aecedc1a84d96487af9d58b5289466232ae952f3dc7117a5
SSDEEP

3072:EQe57YK9IMU2YoOVxYOr9Gf3NNUqK3txS1yHr8p5RR2LYTpW:EQQ78v2Yoadr0f93KOkgTW

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader First Stage 1 IoCs

resource	yara_rule
behavioral2/memory/2388-12-0x0000000000400000-0x000000000042F000-memory.dmp	modiloader_stage1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	dbc9ddb662532c71ba27c24970ed70c1_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4452	pohernah.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\pohernah.exe	dbc9ddb662532c71ba27c24970ed70c1_JaffaCakes118.exe
File created	C:\Windows\noobsaibot.jpg	dbc9ddb662532c71ba27c24970ed70c1_JaffaCakes118.exe
File opened for modification	C:\Windows\noobsaibot.jpg	dbc9ddb662532c71ba27c24970ed70c1_JaffaCakes118.exe
File created	C:\Windows\pohernah.exe	dbc9ddb662532c71ba27c24970ed70c1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbc9ddb662532c71ba27c24970ed70c1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pohernah.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 4452	2388	dbc9ddb662532c71ba27c24970ed70c1_JaffaCakes118.exe	83
PID 2388 wrote to memory of 4452	2388	dbc9ddb662532c71ba27c24970ed70c1_JaffaCakes118.exe	83
PID 2388 wrote to memory of 4452	2388	dbc9ddb662532c71ba27c24970ed70c1_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\dbc9ddb662532c71ba27c24970ed70c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dbc9ddb662532c71ba27c24970ed70c1_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\pohernah.exe
  "C:\Windows\pohernah.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\pohernah.exe

Filesize
29KB

MD5
d5bbfc2847aae502753f757698b8a775

SHA1
57f989bdfa9043622aed7d0dda64e99c5e40a5c1

SHA256
4ed37ea4a12d28da14c9efb9975390ae7cf4e1279fb6cc0c9f4161afbf18d157

SHA512
efed35c5cdd4c1cae7876d98f3b581427f0cdce6e1cef7fc787280c589bcdc468ead9e855c0973d2bd4d3fc3baea8bc712cd7f269a821586451e29b17e640b11

Download Submit
memory/2388-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4452-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4452-13-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download