modiloader | db4ba35b3aeae2d07b87004b202663bc3d78e29b0188db0d9321ffcfe7ded1c5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 04:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_020b40f01a98e5b6ed96705163529faa.exe
Size

72KB
MD5

020b40f01a98e5b6ed96705163529faa
SHA1

4240b02cf37ab867e786f69f038401852dc1ac0e
SHA256

db4ba35b3aeae2d07b87004b202663bc3d78e29b0188db0d9321ffcfe7ded1c5
SHA512

afbd52f371bf514f7f87ed0ff1aacec8820f16c90b6e716d4a2f8d3c845aedc745235c58183740b773c824c1db606719bbcdfed971eeb62cb1942061f4eee46d
SSDEEP

1536:adAyopai/zkM6ZTeCgZliNFJVPZ9kUbjS9M0um23ji:aOUQMJxgVW0u9W

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/1312-8-0x0000000000400000-0x0000000000419000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	JaffaCakes118_020b40f01a98e5b6ed96705163529faa.exe

Executes dropped EXE 1 IoCs

pid	Process
2304	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4884	2304	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_020b40f01a98e5b6ed96705163529faa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 2304	1312	JaffaCakes118_020b40f01a98e5b6ed96705163529faa.exe	83
PID 1312 wrote to memory of 2304	1312	JaffaCakes118_020b40f01a98e5b6ed96705163529faa.exe	83
PID 1312 wrote to memory of 2304	1312	JaffaCakes118_020b40f01a98e5b6ed96705163529faa.exe	83

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_020b40f01a98e5b6ed96705163529faa.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_020b40f01a98e5b6ed96705163529faa.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 376
    3⤵
    - Program crash
    PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2304 -ip 2304
1⤵
PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
58KB

MD5
94832d355493f1b02c02bfb4f17a4173

SHA1
7d70ab91c42dd5c20178abbae3f8cafcbac3a8c2

SHA256
f020dabf321c5090a7fe4b50a46c15de10740ac677bce0c0af54ebbae5c78c8d

SHA512
ec5c570b35f5082cd771b659968f4e1d38a234860ea24ab4b275e5f22269a4a8862e56bc9e70696d39a12553eb76028f2d527e564314d2a977f4dc2c4744623f

Download Submit
memory/1312-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download