modiloader | a54d77207216846a752b63e2c573f2de5fef47656225efc4decd158455f61582

Analysis

max time kernel
93s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_03c03727ff292aafd48d6abcbebc8d76.exe
Size

1.2MB
MD5

03c03727ff292aafd48d6abcbebc8d76
SHA1

cb9f5c55a44a49138a998c2884e8828746386597
SHA256

a54d77207216846a752b63e2c573f2de5fef47656225efc4decd158455f61582
SHA512

1742fc065f139a47c03ff32df3b6b2bb14d9e18eff3529d366d420fd0c4557dfae1b334942745db6b873335e49d745bb6606d0c938e8350f9bf6c8963671a92f
SSDEEP

24576:G99jZm9amAuGmG/N2jVoyy5kiubya6PjauAUeM3Nw5W+7ma+I:G99j8amAuG9V2RoX5/XaEhB3qgO

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/1724-30-0x0000000000400000-0x000000000072C000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	JaffaCakes118_03c03727ff292aafd48d6abcbebc8d76.exe

Executes dropped EXE 1 IoCs

pid	Process
2200	EromUpgrade.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_03c03727ff292aafd48d6abcbebc8d76.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EromUpgrade.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2200	EromUpgrade.exe
2200	EromUpgrade.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2200	1724	JaffaCakes118_03c03727ff292aafd48d6abcbebc8d76.exe	83
PID 1724 wrote to memory of 2200	1724	JaffaCakes118_03c03727ff292aafd48d6abcbebc8d76.exe	83
PID 1724 wrote to memory of 2200	1724	JaffaCakes118_03c03727ff292aafd48d6abcbebc8d76.exe	83

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03c03727ff292aafd48d6abcbebc8d76.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03c03727ff292aafd48d6abcbebc8d76.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\EromUpgrade.exe
  "C:\Users\Admin\AppData\Local\Temp\EromUpgrade.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\EromUpgrade.exe

Filesize
384KB

MD5
8b8cabd93997db913a68cfc39a0b881e

SHA1
f0fea8e209dbfa28452047eb571d22720a3c7674

SHA256
25a1f18fb6ae9d208a2c0b218bdc38fbad2f50c4c510c756a11b16e452d830b3

SHA512
3470e85b514a4855e9c7eaa2802a4fe94f834135a54324476817a3a05c855d86b69449b6379dfe0266eb3a1e2479f02adb6834334d9895cd50629322ad141e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\compatui.dll

Filesize
437KB

MD5
9afd61a19fdd19ebf9c6691832e55b72

SHA1
fd815bfbd74e68c08e9be7fd2ad57907b61b5da5

SHA256
6fc86274873dbe417b02b296d881e85b84f34fd8b64717f36ea12de634674b76

SHA512
61be9e4f4f9accd62efbd4e1658f07b8ff92a654a974ad93dc9a9100697e1c919c4777b6b25e89b7c438c109600ae009341801575702a585dcd9939eefaf8605

Download Submit
memory/1724-7-0x0000000076800000-0x0000000076801000-memory.dmp

Filesize
4KB

Download
memory/1724-3-0x0000000002730000-0x0000000002740000-memory.dmp

Filesize
64KB

Download
memory/1724-0-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/1724-6-0x00000000026D0000-0x00000000026E0000-memory.dmp

Filesize
64KB

Download
memory/1724-9-0x00000000767E0000-0x00000000768D0000-memory.dmp

Filesize
960KB

Download
memory/1724-5-0x0000000002880000-0x0000000002890000-memory.dmp

Filesize
64KB

Download
memory/1724-2-0x0000000000400000-0x000000000072C000-memory.dmp

Filesize
3.2MB

Download
memory/1724-8-0x00000000767E0000-0x00000000768D0000-memory.dmp

Filesize
960KB

Download
memory/1724-10-0x00000000767E0000-0x00000000768D0000-memory.dmp

Filesize
960KB

Download
memory/1724-12-0x00000000767E0000-0x00000000768D0000-memory.dmp

Filesize
960KB

Download
memory/1724-4-0x00000000777C2000-0x00000000777C3000-memory.dmp

Filesize
4KB

Download
memory/1724-1-0x0000000000D20000-0x0000000000D6E000-memory.dmp

Filesize
312KB

Download
memory/1724-32-0x00000000767E0000-0x00000000768D0000-memory.dmp

Filesize
960KB

Download
memory/1724-30-0x0000000000400000-0x000000000072C000-memory.dmp

Filesize
3.2MB

Download
memory/1724-31-0x0000000000D20000-0x0000000000D6E000-memory.dmp

Filesize
312KB

Download