modiloader | b10f457d04d2c040a1d69cde46ef8f6135ee3e996dbbd8568dc9c22b3afba450

Analysis

max time kernel
141s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe
Size

2.2MB
MD5

fc3bfe248591925ccdadd17307a476eb
SHA1

2f0ad1fe100affd79d9b52f8eb97905177da56ba
SHA256

b10f457d04d2c040a1d69cde46ef8f6135ee3e996dbbd8568dc9c22b3afba450
SHA512

cf2dacb84decf2ddda20a0e40e294ee302b789ea6ce21b9fa64d5fe57f7ac51c071f26142533cb42c2a9e0d5687cf7548e6d848d7e6b863ea623e8fb7bc5f79e
SSDEEP

49152:/H67ec//////RTaARjzI0nSNrN3yOGlp2NIqDxs6TdMv3Plg0jI2SmS:/H67ec//////Q8jPSZN3yOYpeIqtdMv0

Score

10^/10

modiloader discovery evasion trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	system325-Cha Public Client_0308.exe

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral1/memory/2772-10-0x0000000000401000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral1/memory/2772-8-0x0000000000400000-0x000000000046E000-memory.dmp	modiloader_stage2
behavioral1/memory/2772-26-0x0000000000401000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral1/memory/2772-25-0x0000000000400000-0x000000000046E000-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

pid	Process
2772	system32Gar2Ide.exe
2812	system325-Cha Public Client_0308.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	system325-Cha Public Client_0308.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2812	system325-Cha Public Client_0308.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\system325-Cha Public Client_0308.exe	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe
File created	C:\WINDOWS\_xr.bat	system32Gar2Ide.exe
File created	C:\WINDOWS\system32Gar2Ide.exe	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system325-Cha Public Client_0308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32Gar2Ide.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	system325-Cha Public Client_0308.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	system325-Cha Public Client_0308.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	system325-Cha Public Client_0308.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{729B6C61-BDC5-4C09-A1DE-A296BA0B89EC}\InProcServer32\ThreadingModel = "Apartment"	system32Gar2Ide.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{729B6C61-BDC5-4C09-A1DE-A296BA0B89EC}	system32Gar2Ide.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{729B6C61-BDC5-4C09-A1DE-A296BA0B89EC}\	system32Gar2Ide.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{729B6C61-BDC5-4C09-A1DE-A296BA0B89EC}\InProcServer32	system32Gar2Ide.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{729B6C61-BDC5-4C09-A1DE-A296BA0B89EC}\InProcServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\MSINFO\\SysInfo.dll"	system32Gar2Ide.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2812	system325-Cha Public Client_0308.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	system325-Cha Public Client_0308.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2812	system325-Cha Public Client_0308.exe
2812	system325-Cha Public Client_0308.exe
2812	system325-Cha Public Client_0308.exe
2812	system325-Cha Public Client_0308.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 2288	1268	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe	29
PID 1268 wrote to memory of 2288	1268	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe	29
PID 1268 wrote to memory of 2288	1268	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe	29
PID 1268 wrote to memory of 2288	1268	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe	29
PID 1268 wrote to memory of 1248	1268	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe	31
PID 1268 wrote to memory of 1248	1268	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe	31
PID 1268 wrote to memory of 1248	1268	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe	31
PID 1268 wrote to memory of 1248	1268	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe	31
PID 2288 wrote to memory of 2772	2288	cmd.exe	33
PID 2288 wrote to memory of 2772	2288	cmd.exe	33
PID 2288 wrote to memory of 2772	2288	cmd.exe	33
PID 2288 wrote to memory of 2772	2288	cmd.exe	33
PID 1248 wrote to memory of 2812	1248	cmd.exe	34
PID 1248 wrote to memory of 2812	1248	cmd.exe	34
PID 1248 wrote to memory of 2812	1248	cmd.exe	34
PID 1248 wrote to memory of 2812	1248	cmd.exe	34
PID 2772 wrote to memory of 3016	2772	system32Gar2Ide.exe	35
PID 2772 wrote to memory of 3016	2772	system32Gar2Ide.exe	35
PID 2772 wrote to memory of 3016	2772	system32Gar2Ide.exe	35
PID 2772 wrote to memory of 3016	2772	system32Gar2Ide.exe	35

C:\Users\Admin\AppData\Local\Temp\fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\WINDOWS\system32Gar2Ide.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\WINDOWS\system32Gar2Ide.exe
    C:\WINDOWS\system32Gar2Ide.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\WINDOWS\_xr.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\WINDOWS\system325-Cha Public Client_0308.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\WINDOWS\system325-Cha Public Client_0308.exe
    "C:\WINDOWS\system325-Cha Public Client_0308.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8P9TO0C6\errorPageStrings[1]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\httpErrorPagesScripts[1]

Filesize
8KB

MD5
3f57b781cb3ef114dd0b665151571b7b

SHA1
ce6a63f996df3a1cccb81720e21204b825e0238c

SHA256
46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

SHA512
8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Download Submit
C:\WINDOWS\system325-Cha Public Client_0308.exe

Filesize
1.5MB

MD5
12355a49fba3ed5419cc30e41258229f

SHA1
f9762c54718ceeef79a3672be7aa2c833eeb1602

SHA256
9da22a52c9bad67427b67b676dc7c111df19661f3d4513b04457bdfe0859ae69

SHA512
940bd1ed12480506444c1eb1f1e31808294aeb48e917b3ed1ab8cdf8bcaa0ddf0ba831c099ba1c40293dcf07b86ad321f5345ad0f57d08ae5623594e2cf19efc

Download Submit
C:\WINDOWS\system32Gar2Ide.exe

Filesize
128KB

MD5
6e00045cd48ccf3ad4b0dfba22725eb3

SHA1
85cb2775da02c8484be111be98d627d378ba8f10

SHA256
395d7cc2dc18e4d8c8b8760d98a1bbb2e9154bf6975c0a592655eaaa56342ac3

SHA512
19b7e65043a08f4cc1e5d832d042e09e38085858a841f6430425113a3290d625037da8938dd5084644ba4039d855f292419536fb42afeb912df23407c3783dae

Download Submit
C:\Windows\_xr.bat

Filesize
104B

MD5
2f550a75d04816d23af8611ebcefeb30

SHA1
6542f5824ed6cae2b198aa11f0343ea69f00c43b

SHA256
c9dd30e632453b73b75a2b5e217328f05e18be82556a2126322d64038d33d405

SHA512
8322b20ee073f7b586260907a9308066cd8e0b74a7e21d3af635a44277f3f99df7766aa54d04a20fe89f4a2bc76f3e99232e55d6e11ae4fd2957e164b66e0dd9

Download Submit
memory/1248-15-0x00000000020A0000-0x000000000240B000-memory.dmp

Filesize
3.4MB

Download
memory/1248-14-0x00000000020A0000-0x000000000240B000-memory.dmp

Filesize
3.4MB

Download
memory/1268-1-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/1268-3-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/2288-5-0x0000000000370000-0x00000000003DE000-memory.dmp

Filesize
440KB

Download
memory/2772-10-0x0000000000401000-0x000000000041B000-memory.dmp

Filesize
104KB

Download
memory/2772-9-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2772-8-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2772-7-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2772-26-0x0000000000401000-0x000000000041B000-memory.dmp

Filesize
104KB

Download
memory/2772-25-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2812-37-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download
memory/2812-90-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-31-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-32-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-33-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-34-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-29-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-35-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download
memory/2812-39-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-40-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-41-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-42-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-81-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-28-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-16-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-30-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-91-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-92-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-93-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-94-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-95-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-96-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-97-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-98-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-99-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-100-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-101-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-102-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-103-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-104-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/2812-105-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download