modiloader | ed3bae7c936380c0b0dedd62061362892a86d0fcadcbc0d530366ff2afd939a7

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 06:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa7cee465d0b4bd7504fe6c72a47b87d_JaffaCakes118.exe
Size

596KB
MD5

fa7cee465d0b4bd7504fe6c72a47b87d
SHA1

f4fc8072ba19bc951b2cbae404c0feb0b8058c0d
SHA256

ed3bae7c936380c0b0dedd62061362892a86d0fcadcbc0d530366ff2afd939a7
SHA512

fba467df69cf5afd70efa826d46941d3bc29331366e60a066599d03eafd3e591cad4f250a1888ad950f08fccb64a6654b93108ffc72c851efcf34dec8ffb9f1d
SSDEEP

12288:Hd5lL52zyb4gqfjXCjpdkYWF3Z4mxxTDqVTVOClY:HVL+5rX7QmX6VTzlY

Score

10^/10

modiloader defense_evasion discovery persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/memory/2320-19-0x0000000010410000-0x000000001048C000-memory.dmp	modiloader_stage2
behavioral1/memory/2320-28-0x0000000013140000-0x00000000131D2000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
2320	Ñ}Ñu-2~1.EXE

Loads dropped DLL 3 IoCs

pid	Process
2460	fa7cee465d0b4bd7504fe6c72a47b87d_JaffaCakes118.exe
2460	fa7cee465d0b4bd7504fe6c72a47b87d_JaffaCakes118.exe
2320	Ñ}Ñu-2~1.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fa7cee465d0b4bd7504fe6c72a47b87d_JaffaCakes118.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000186f2-6.dat	upx
behavioral1/memory/2460-8-0x0000000013140000-0x00000000131D2000-memory.dmp	upx
behavioral1/memory/2320-14-0x0000000013140000-0x00000000131D2000-memory.dmp	upx
behavioral1/memory/2320-28-0x0000000013140000-0x00000000131D2000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fa7cee465d0b4bd7504fe6c72a47b87d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ñ}Ñu-2~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2320	Ñ}Ñu-2~1.EXE

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeBackupPrivilege	2320	Ñ}Ñu-2~1.EXE
Token: SeRestorePrivilege	2320	Ñ}Ñu-2~1.EXE
Token: SeRestorePrivilege	2320	Ñ}Ñu-2~1.EXE
Token: SeRestorePrivilege	2320	Ñ}Ñu-2~1.EXE
Token: SeRestorePrivilege	2320	Ñ}Ñu-2~1.EXE
Token: SeRestorePrivilege	2320	Ñ}Ñu-2~1.EXE
Token: SeBackupPrivilege	2320	Ñ}Ñu-2~1.EXE
Token: SeRestorePrivilege	2320	Ñ}Ñu-2~1.EXE
Token: SeRestorePrivilege	2320	Ñ}Ñu-2~1.EXE
Token: SeRestorePrivilege	2320	Ñ}Ñu-2~1.EXE
Token: SeRestorePrivilege	2320	Ñ}Ñu-2~1.EXE
Token: SeRestorePrivilege	2320	Ñ}Ñu-2~1.EXE
Token: SeDebugPrivilege	2320	Ñ}Ñu-2~1.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2320	2460	fa7cee465d0b4bd7504fe6c72a47b87d_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2320	2460	fa7cee465d0b4bd7504fe6c72a47b87d_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2320	2460	fa7cee465d0b4bd7504fe6c72a47b87d_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2320	2460	fa7cee465d0b4bd7504fe6c72a47b87d_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2320	2460	fa7cee465d0b4bd7504fe6c72a47b87d_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2320	2460	fa7cee465d0b4bd7504fe6c72a47b87d_JaffaCakes118.exe	31
PID 2460 wrote to memory of 2320	2460	fa7cee465d0b4bd7504fe6c72a47b87d_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32
PID 2320 wrote to memory of 2416	2320	Ñ}Ñu-2~1.EXE	32

C:\Users\Admin\AppData\Local\Temp\fa7cee465d0b4bd7504fe6c72a47b87d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa7cee465d0b4bd7504fe6c72a47b87d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ñ}Ñu-2~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ñ}Ñu-2~1.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" about:blank
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ñ}Ñu-2~1.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ñ}Ñu-2~1.EXE

Filesize
241KB

MD5
2a5f8e52330b3b3d959d46df199eac47

SHA1
c0ae6c5f08bb4e090d07848a0820bbe16b1ab9c5

SHA256
80730bf76d1b38156eb82425f26c7bfe8f267f1761d3c1dc8270d91a4ce7babd

SHA512
322c280f07cb53206b8398b1cbdddf859a80cc6850b3f4a5288cd9d9b3230d3d5e450f57ca652da5a8de80fbb1c14abb77869e3449e5b60eb3c96d9a5d952421

Download Submit
memory/2320-14-0x0000000013140000-0x00000000131D2000-memory.dmp

Filesize
584KB

Download
memory/2320-19-0x0000000010410000-0x000000001048C000-memory.dmp

Filesize
496KB

Download
memory/2320-28-0x0000000013140000-0x00000000131D2000-memory.dmp

Filesize
584KB

Download
memory/2460-0-0x0000000001000000-0x00000000010A1000-memory.dmp

Filesize
644KB

Download
memory/2460-1-0x000000000104E000-0x000000000104F000-memory.dmp

Filesize
4KB

Download
memory/2460-2-0x0000000001000000-0x00000000010A1000-memory.dmp

Filesize
644KB

Download
memory/2460-5-0x0000000001000000-0x00000000010A1000-memory.dmp

Filesize
644KB

Download
memory/2460-8-0x0000000013140000-0x00000000131D2000-memory.dmp

Filesize
584KB

Download
memory/2460-29-0x0000000001000000-0x00000000010A1000-memory.dmp

Filesize
644KB

Download