modiloader | 12db2994ef1b9c68f53a45db1930c39a5df0db85f8563e0b74f19463b737f851

Analysis

max time kernel
94s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2024 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe
Size

25KB
MD5

e8328fb501ec0a4de3fdf9311dc5bec9
SHA1

e77365beb66a811bbc4802f6d51021b0786d40b7
SHA256

12db2994ef1b9c68f53a45db1930c39a5df0db85f8563e0b74f19463b737f851
SHA512

5170da7fe8d8365051d481b152728e67c1c2877843cf8999e3c9739acf8f0862fdaaa3cd5b85a60f691346d050ca90599232a6ed243d36db174bd17b65e59635
SSDEEP

384:dhx0CcxqjIGXQGRpG6OeEZZB3o60wVLf/vCm3zQs/AAOHmbdKMvZvxRJe:+CYqjLQSs6HAa6pVLPjGhmcMvZ5O

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/1240-1-0x0000000010000000-0x000000001000E000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1240 set thread context of 1740	1240	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	1740	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1740	1240	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe	82
PID 1240 wrote to memory of 1740	1240	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe	82
PID 1240 wrote to memory of 1740	1240	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe	82
PID 1240 wrote to memory of 1740	1240	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe	82
PID 1240 wrote to memory of 1740	1240	e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Local\Temp\e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e8328fb501ec0a4de3fdf9311dc5bec9_JaffaCakes118.exe
  2⤵
  PID:1740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 464
    3⤵
    - Program crash
    PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1740 -ip 1740
1⤵
PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1240-1-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1740-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1740-3-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download