modiloader | ef3a9fdddcf17a8314e887f78b4e1f91a34e9f5981c8c2893d718cad593f91ca

Analysis

max time kernel
95s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-12-2024 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1e25f0ba30ab1557f6bb0478bc59073_JaffaCakes118.exe
Size

40KB
MD5

f1e25f0ba30ab1557f6bb0478bc59073
SHA1

c8f59fc2b649f8b39f99a8c9eb71fa477ea45f3f
SHA256

ef3a9fdddcf17a8314e887f78b4e1f91a34e9f5981c8c2893d718cad593f91ca
SHA512

ceb6b2834ea1cdbdd226072cf922264cb0ca5b9d9557159f60236c4d468a98ac17cefee31b1d2526644260d9f0439b847afaa613734d60d06533603a98948c1a
SSDEEP

768:B4B2JGYVNfV6vrFDPwp2Gt7YHN0m5vcdXwPXDzHvzExAPOE/3MwVrJ7H8oWXRrK6:BC2oAfIrJwp2Gium5vcxwPzzvzEx6L/U

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/1420-12-0x00000000023A0000-0x00000000023C4000-memory.dmp	modiloader_stage2

Loads dropped DLL 2 IoCs

pid	Process
1420	f1e25f0ba30ab1557f6bb0478bc59073_JaffaCakes118.exe
1420	f1e25f0ba30ab1557f6bb0478bc59073_JaffaCakes118.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\atmQQ2.dll	f1e25f0ba30ab1557f6bb0478bc59073_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f1e25f0ba30ab1557f6bb0478bc59073_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1420	f1e25f0ba30ab1557f6bb0478bc59073_JaffaCakes118.exe
1420	f1e25f0ba30ab1557f6bb0478bc59073_JaffaCakes118.exe
1420	f1e25f0ba30ab1557f6bb0478bc59073_JaffaCakes118.exe
1420	f1e25f0ba30ab1557f6bb0478bc59073_JaffaCakes118.exe
1420	f1e25f0ba30ab1557f6bb0478bc59073_JaffaCakes118.exe
1420	f1e25f0ba30ab1557f6bb0478bc59073_JaffaCakes118.exe
1420	f1e25f0ba30ab1557f6bb0478bc59073_JaffaCakes118.exe
1420	f1e25f0ba30ab1557f6bb0478bc59073_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1420	f1e25f0ba30ab1557f6bb0478bc59073_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f1e25f0ba30ab1557f6bb0478bc59073_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f1e25f0ba30ab1557f6bb0478bc59073_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\MSInfo\atmQQ2.dll

Filesize
21KB

MD5
25a74f9ab0a1b77075427cf904b4a2b5

SHA1
dcce1808fd3fad85bcbc3005b69a040e44a14c95

SHA256
ba26f72e52fe46f7da78fc31c1de4a8eb249bd7542fe3fc024cdeed056f5dc31

SHA512
4eb010ce63da3d2de22f672b69f19c964422e968939af71e6c77623e8ed1a99545d37bd628ff18b82cd01a7ee00ee8bf1746bad1fc4f71029adc2d0768aa47d3

Download Submit
memory/1420-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1420-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1420-9-0x00000000023A0000-0x00000000023C4000-memory.dmp

Filesize
144KB

Download
memory/1420-8-0x00000000023A0000-0x00000000023C4000-memory.dmp

Filesize
144KB

Download
memory/1420-10-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1420-11-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1420-12-0x00000000023A0000-0x00000000023C4000-memory.dmp

Filesize
144KB

Download