modiloader | 693d7207ecc9e923bd67a8b427bd7f7486dd86e5eec2e3f31502bc29e45b2a4c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-01-2025 07:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_636cf7d7dd48b4b37264f37c45be17f0.exe
Size

36KB
MD5

636cf7d7dd48b4b37264f37c45be17f0
SHA1

9e9af9eb0e9059610499e8200746f46b9a6caf76
SHA256

693d7207ecc9e923bd67a8b427bd7f7486dd86e5eec2e3f31502bc29e45b2a4c
SHA512

b766e1bb2ff81b8ff3338aabba30076d4cc053d0abe539adc87de56e6430da30a9e4a9c69f2ed73d0b3d80ab25480f9fc6e42cda7bad586af6e4680c085e5846
SSDEEP

768:ugW2wtPxb7vy56dv5uRJhE3NoGEq/peI/fwXIVBi87KNix:ugetm5cwhip3fWcKNix

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/3940-9-0x00000000006D0000-0x00000000006EF000-memory.dmp	modiloader_stage2
behavioral2/memory/3940-11-0x00000000006D0000-0x00000000006EF000-memory.dmp	modiloader_stage2

Loads dropped DLL 2 IoCs

pid	Process
3940	JaffaCakes118_636cf7d7dd48b4b37264f37c45be17f0.exe
3940	JaffaCakes118_636cf7d7dd48b4b37264f37c45be17f0.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\atmQQ2.dll	JaffaCakes118_636cf7d7dd48b4b37264f37c45be17f0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_636cf7d7dd48b4b37264f37c45be17f0.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3940	JaffaCakes118_636cf7d7dd48b4b37264f37c45be17f0.exe
3940	JaffaCakes118_636cf7d7dd48b4b37264f37c45be17f0.exe
3940	JaffaCakes118_636cf7d7dd48b4b37264f37c45be17f0.exe
3940	JaffaCakes118_636cf7d7dd48b4b37264f37c45be17f0.exe
3940	JaffaCakes118_636cf7d7dd48b4b37264f37c45be17f0.exe
3940	JaffaCakes118_636cf7d7dd48b4b37264f37c45be17f0.exe
3940	JaffaCakes118_636cf7d7dd48b4b37264f37c45be17f0.exe
3940	JaffaCakes118_636cf7d7dd48b4b37264f37c45be17f0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3940	JaffaCakes118_636cf7d7dd48b4b37264f37c45be17f0.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_636cf7d7dd48b4b37264f37c45be17f0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_636cf7d7dd48b4b37264f37c45be17f0.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\MSInfo\atmQQ2.dll

Filesize
25KB

MD5
81b11eec5cfaade7470f1bf2d7f2d115

SHA1
56c19665f95aec4ca43aca8b9bb6ecc217be48ca

SHA256
afe23462be97198678a26389d315731495b1bf5558ed00f1be81619b8f4d6da6

SHA512
029f9e5b19aed620fe7a298a9cca87a72dd4f8661f70567101bf50a92ca654d991676f75e9575c25694810b67789b09fce3a8077f961959ae500a40a9e2faa11

Download Submit
memory/3940-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3940-5-0x00000000006D0000-0x00000000006EF000-memory.dmp

Filesize
124KB

Download
memory/3940-8-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/3940-9-0x00000000006D0000-0x00000000006EF000-memory.dmp

Filesize
124KB

Download
memory/3940-10-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3940-11-0x00000000006D0000-0x00000000006EF000-memory.dmp

Filesize
124KB

Download
memory/3940-12-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download