modiloader | b10f457d04d2c040a1d69cde46ef8f6135ee3e996dbbd8568dc9c22b3afba450

Analysis

max time kernel
140s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe
Size

2.2MB
MD5

fc3bfe248591925ccdadd17307a476eb
SHA1

2f0ad1fe100affd79d9b52f8eb97905177da56ba
SHA256

b10f457d04d2c040a1d69cde46ef8f6135ee3e996dbbd8568dc9c22b3afba450
SHA512

cf2dacb84decf2ddda20a0e40e294ee302b789ea6ce21b9fa64d5fe57f7ac51c071f26142533cb42c2a9e0d5687cf7548e6d848d7e6b863ea623e8fb7bc5f79e
SSDEEP

49152:/H67ec//////RTaARjzI0nSNrN3yOGlp2NIqDxs6TdMv3Plg0jI2SmS:/H67ec//////Q8jPSZN3yOYpeIqtdMv0

Score

10^/10

modiloader discovery evasion trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	system325-Cha Public Client_0308.exe

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral2/memory/1932-11-0x0000000000400000-0x000000000046E000-memory.dmp	modiloader_stage2
behavioral2/memory/1932-15-0x0000000000401000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral2/memory/1932-20-0x0000000000401000-0x000000000041B000-memory.dmp	modiloader_stage2
behavioral2/memory/1932-19-0x0000000000400000-0x000000000046E000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	system32Gar2Ide.exe

Executes dropped EXE 2 IoCs

pid	Process
1932	system32Gar2Ide.exe
4804	system325-Cha Public Client_0308.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine	system325-Cha Public Client_0308.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4804	system325-Cha Public Client_0308.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\system32Gar2Ide.exe	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe
File created	C:\WINDOWS\system325-Cha Public Client_0308.exe	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe
File created	C:\WINDOWS\_xr.bat	system32Gar2Ide.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system32Gar2Ide.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system325-Cha Public Client_0308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\IESettingSync	system325-Cha Public Client_0308.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	system325-Cha Public Client_0308.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	system325-Cha Public Client_0308.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	system325-Cha Public Client_0308.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{729B6C61-BDC5-4C09-A1DE-A296BA0B89EC}\	system32Gar2Ide.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{729B6C61-BDC5-4C09-A1DE-A296BA0B89EC}\InProcServer32	system32Gar2Ide.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{729B6C61-BDC5-4C09-A1DE-A296BA0B89EC}\InProcServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\MSINFO\\SysInfo.dll"	system32Gar2Ide.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{729B6C61-BDC5-4C09-A1DE-A296BA0B89EC}\InProcServer32\ThreadingModel = "Apartment"	system32Gar2Ide.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{729B6C61-BDC5-4C09-A1DE-A296BA0B89EC}	system32Gar2Ide.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4804	system325-Cha Public Client_0308.exe
4804	system325-Cha Public Client_0308.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4804	system325-Cha Public Client_0308.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4804	system325-Cha Public Client_0308.exe
4804	system325-Cha Public Client_0308.exe
4804	system325-Cha Public Client_0308.exe
4804	system325-Cha Public Client_0308.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 2680	392	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe	83
PID 392 wrote to memory of 2680	392	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe	83
PID 392 wrote to memory of 2680	392	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe	83
PID 392 wrote to memory of 60	392	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe	85
PID 392 wrote to memory of 60	392	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe	85
PID 392 wrote to memory of 60	392	fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe	85
PID 2680 wrote to memory of 1932	2680	cmd.exe	87
PID 2680 wrote to memory of 1932	2680	cmd.exe	87
PID 2680 wrote to memory of 1932	2680	cmd.exe	87
PID 60 wrote to memory of 4804	60	cmd.exe	88
PID 60 wrote to memory of 4804	60	cmd.exe	88
PID 60 wrote to memory of 4804	60	cmd.exe	88
PID 1932 wrote to memory of 4400	1932	system32Gar2Ide.exe	89
PID 1932 wrote to memory of 4400	1932	system32Gar2Ide.exe	89
PID 1932 wrote to memory of 4400	1932	system32Gar2Ide.exe	89

C:\Users\Admin\AppData\Local\Temp\fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc3bfe248591925ccdadd17307a476eb_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\WINDOWS\system32Gar2Ide.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\WINDOWS\system32Gar2Ide.exe
    C:\WINDOWS\system32Gar2Ide.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\WINDOWS\_xr.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:4400
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\WINDOWS\system325-Cha Public Client_0308.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\WINDOWS\system325-Cha Public Client_0308.exe
    "C:\WINDOWS\system325-Cha Public Client_0308.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YY018DS9\errorPageStrings[1]

Filesize
4KB

MD5
d65ec06f21c379c87040b83cc1abac6b

SHA1
208d0a0bb775661758394be7e4afb18357e46c8b

SHA256
a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f

SHA512
8a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YY018DS9\httpErrorPagesScripts[1]

Filesize
11KB

MD5
9234071287e637f85d721463c488704c

SHA1
cca09b1e0fba38ba29d3972ed8dcecefdef8c152

SHA256
65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649

SHA512
87d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384

Download Submit
C:\WINDOWS\_xr.bat

Filesize
104B

MD5
2f550a75d04816d23af8611ebcefeb30

SHA1
6542f5824ed6cae2b198aa11f0343ea69f00c43b

SHA256
c9dd30e632453b73b75a2b5e217328f05e18be82556a2126322d64038d33d405

SHA512
8322b20ee073f7b586260907a9308066cd8e0b74a7e21d3af635a44277f3f99df7766aa54d04a20fe89f4a2bc76f3e99232e55d6e11ae4fd2957e164b66e0dd9

Download Submit
C:\Windows\system325-Cha Public Client_0308.exe

Filesize
1.5MB

MD5
12355a49fba3ed5419cc30e41258229f

SHA1
f9762c54718ceeef79a3672be7aa2c833eeb1602

SHA256
9da22a52c9bad67427b67b676dc7c111df19661f3d4513b04457bdfe0859ae69

SHA512
940bd1ed12480506444c1eb1f1e31808294aeb48e917b3ed1ab8cdf8bcaa0ddf0ba831c099ba1c40293dcf07b86ad321f5345ad0f57d08ae5623594e2cf19efc

Download Submit
C:\Windows\system32Gar2Ide.exe

Filesize
128KB

MD5
6e00045cd48ccf3ad4b0dfba22725eb3

SHA1
85cb2775da02c8484be111be98d627d378ba8f10

SHA256
395d7cc2dc18e4d8c8b8760d98a1bbb2e9154bf6975c0a592655eaaa56342ac3

SHA512
19b7e65043a08f4cc1e5d832d042e09e38085858a841f6430425113a3290d625037da8938dd5084644ba4039d855f292419536fb42afeb912df23407c3783dae

Download Submit
memory/392-3-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/392-0-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/1932-11-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1932-15-0x0000000000401000-0x000000000041B000-memory.dmp

Filesize
104KB

Download
memory/1932-20-0x0000000000401000-0x000000000041B000-memory.dmp

Filesize
104KB

Download
memory/1932-19-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1932-9-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/1932-7-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4804-31-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-70-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-25-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-26-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-27-0x0000000005AE0000-0x0000000005AE1000-memory.dmp

Filesize
4KB

Download
memory/4804-29-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-30-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-23-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-32-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-37-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-36-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-51-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-22-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-14-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-69-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-24-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-71-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-72-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-73-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-74-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-75-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-76-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-77-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-78-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-79-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-80-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-81-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-82-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-83-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download
memory/4804-84-0x0000000000400000-0x000000000076B000-memory.dmp

Filesize
3.4MB

Download