modiloader | 12db2994ef1b9c68f53a45db1930c39a5df0db85f8563e0b74f19463b737f851

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-12-2024 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe
Size

25KB
MD5

e8328fb501ec0a4de3fdf9311dc5bec9
SHA1

e77365beb66a811bbc4802f6d51021b0786d40b7
SHA256

12db2994ef1b9c68f53a45db1930c39a5df0db85f8563e0b74f19463b737f851
SHA512

5170da7fe8d8365051d481b152728e67c1c2877843cf8999e3c9739acf8f0862fdaaa3cd5b85a60f691346d050ca90599232a6ed243d36db174bd17b65e59635
SSDEEP

384:dhx0CcxqjIGXQGRpG6OeEZZB3o60wVLf/vCm3zQs/AAOHmbdKMvZvxRJe:+CYqjLQSs6HAa6pVLPjGhmcMvZ5O

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2108-4-0x0000000010000000-0x000000001000E000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2108 set thread context of 1684	2108	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2272	1684	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1684	2108	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe	30
PID 2108 wrote to memory of 1684	2108	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe	30
PID 2108 wrote to memory of 1684	2108	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe	30
PID 2108 wrote to memory of 1684	2108	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe	30
PID 2108 wrote to memory of 1684	2108	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe	30
PID 2108 wrote to memory of 1684	2108	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe	30
PID 1684 wrote to memory of 2272	1684	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe	31
PID 1684 wrote to memory of 2272	1684	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe	31
PID 1684 wrote to memory of 2272	1684	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe	31
PID 1684 wrote to memory of 2272	1684	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Local\Temp\e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 36
    3⤵
    - Program crash
    PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1684-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1684-3-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1684-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1684-8-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2108-4-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download