modiloader | 4bb41907676400e1043908390203b76c1b3c05cf19ce6fb192b4409a702337b0

Analysis

max time kernel
140s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-12-2024 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eefe16c1b7521283b746187d17879cae_JaffaCakes118.exe
Size

172KB
MD5

eefe16c1b7521283b746187d17879cae
SHA1

aff23e7a4019c6ce33467e09d061191fae00fed5
SHA256

4bb41907676400e1043908390203b76c1b3c05cf19ce6fb192b4409a702337b0
SHA512

6e12037eea69eeeaca727ddbe9c5779a9b6ddd468cfd16af6a834c66d046310a41e12b400cf50e7af05a2ab579a3accab465a3b288992bdfd27a46b1433c5e1f
SSDEEP

3072:KYLOvEm3zUDepyOonI+yDEmQ3wO21UFGr:Fw/07dn9IE33JoU4

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 6 IoCs

resource	yara_rule
behavioral2/memory/872-0-0x0000000000400000-0x000000000042B000-memory.dmp	modiloader_stage2
behavioral2/files/0x000c000000023bbe-2.dat	modiloader_stage2
behavioral2/memory/872-5-0x00000000007D0000-0x00000000007E3000-memory.dmp	modiloader_stage2
behavioral2/memory/872-8-0x00000000007D0000-0x00000000007E3000-memory.dmp	modiloader_stage2
behavioral2/memory/872-9-0x0000000000400000-0x000000000042B000-memory.dmp	modiloader_stage2
behavioral2/memory/872-20-0x00000000007D0000-0x00000000007E3000-memory.dmp	modiloader_stage2

Loads dropped DLL 2 IoCs

pid	Process
872	eefe16c1b7521283b746187d17879cae_JaffaCakes118.exe
872	eefe16c1b7521283b746187d17879cae_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.dll	eefe16c1b7521283b746187d17879cae_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eefe16c1b7521283b746187d17879cae_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
872	eefe16c1b7521283b746187d17879cae_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eefe16c1b7521283b746187d17879cae_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eefe16c1b7521283b746187d17879cae_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\MSInfo\SysInfo.dll

Filesize
57KB

MD5
8ca08e5d1d8a87c095554e267eb12fbb

SHA1
a25bc12faa9eef28dfb534d578361eaf99fe3ab7

SHA256
f977408b07b5f33b34d8346b4b1ecc1c14ccf76a0296159c4be12ed309aafc78

SHA512
5f283cb533501140cfd308e0a66a9dd0b6196e02b0feaf7f81999f224309950d10a8ce26363ac4e2a750a74c9546c4bbbdc32d77ff3101a92dad1a0120674520

Download Submit
memory/872-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/872-5-0x00000000007D0000-0x00000000007E3000-memory.dmp

Filesize
76KB

Download
memory/872-8-0x00000000007D0000-0x00000000007E3000-memory.dmp

Filesize
76KB

Download
memory/872-9-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/872-20-0x00000000007D0000-0x00000000007E3000-memory.dmp

Filesize
76KB

Download