modiloader | ae18893b297ac80f970e6a747285debeed5810b959a75dbc60cdeac41ca32785

Analysis

max time kernel
141s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/01/2025, 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9875da8c761a0a14b322b4a0aa0cccd6.exe
Size

6.6MB
MD5

9875da8c761a0a14b322b4a0aa0cccd6
SHA1

e13bde87c662d784bee9c130ac5452569c3c426b
SHA256

ae18893b297ac80f970e6a747285debeed5810b959a75dbc60cdeac41ca32785
SHA512

76491f74042a148a9b4d2a96a3b33ccf015c06f8914e7343186f92e8e27c684a5a56dc6c0909ce382405e1e025193077a09add4863ed64d72494d57244e270a7
SSDEEP

196608:BqLuPUTDOcmXeswTYeJ47pMDn2wFwOqEM8kA:BET6FqYe4C1FRRP

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader First Stage 2 IoCs

resource	yara_rule
behavioral2/memory/1360-4-0x0000000000400000-0x0000000001EBC000-memory.dmp	modiloader_stage1
behavioral2/memory/1360-5-0x0000000000400000-0x0000000001EBC000-memory.dmp	modiloader_stage1

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9875da8c761a0a14b322b4a0aa0cccd6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
1236	regedit.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1360	JaffaCakes118_9875da8c761a0a14b322b4a0aa0cccd6.exe
1360	JaffaCakes118_9875da8c761a0a14b322b4a0aa0cccd6.exe
1360	JaffaCakes118_9875da8c761a0a14b322b4a0aa0cccd6.exe
1360	JaffaCakes118_9875da8c761a0a14b322b4a0aa0cccd6.exe
1360	JaffaCakes118_9875da8c761a0a14b322b4a0aa0cccd6.exe
1360	JaffaCakes118_9875da8c761a0a14b322b4a0aa0cccd6.exe
1360	JaffaCakes118_9875da8c761a0a14b322b4a0aa0cccd6.exe
1360	JaffaCakes118_9875da8c761a0a14b322b4a0aa0cccd6.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 4136	1360	JaffaCakes118_9875da8c761a0a14b322b4a0aa0cccd6.exe	82
PID 1360 wrote to memory of 4136	1360	JaffaCakes118_9875da8c761a0a14b322b4a0aa0cccd6.exe	82
PID 1360 wrote to memory of 1236	1360	JaffaCakes118_9875da8c761a0a14b322b4a0aa0cccd6.exe	84
PID 1360 wrote to memory of 1236	1360	JaffaCakes118_9875da8c761a0a14b322b4a0aa0cccd6.exe	84
PID 1360 wrote to memory of 1236	1360	JaffaCakes118_9875da8c761a0a14b322b4a0aa0cccd6.exe	84

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9875da8c761a0a14b322b4a0aa0cccd6.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9875da8c761a0a14b322b4a0aa0cccd6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4136
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\Users\Admin\AppData\Local\Temp\Substitutions.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:1236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Substitutions.reg

Filesize
37KB

MD5
670378dcb3a84416145ed288664072b1

SHA1
dd7e06eaf408ab4ea9bdec23e8638aacf7f4d08e

SHA256
0edcc178374b494b8c023caf1d6a63eb55ad8b9d0c81a1af3775043e729d513b

SHA512
0e4a9237e6b7a1b9dcbfe445275803e7dc6709cb5d962bd523796f6c4931385ec794689ccfa9b10eab1500800aeb7d4eb07068942f69d769f4be46b8366fc980

Download Submit
memory/1360-0-0x0000000000400000-0x0000000001EBC000-memory.dmp

Filesize
26.7MB

Download
memory/1360-1-0x0000000007870000-0x0000000007871000-memory.dmp

Filesize
4KB

Download
memory/1360-4-0x0000000000400000-0x0000000001EBC000-memory.dmp

Filesize
26.7MB

Download
memory/1360-6-0x0000000007870000-0x0000000007871000-memory.dmp

Filesize
4KB

Download
memory/1360-5-0x0000000000400000-0x0000000001EBC000-memory.dmp

Filesize
26.7MB

Download