modiloader | 15a8b3b9f7b50efb9922d132759d2d3fea482074c5c7acc774d3a6a053a11c89

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-01-2025 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_0b327b88f123510e6b50df100ee9f50b.exe
Size

510KB
MD5

0b327b88f123510e6b50df100ee9f50b
SHA1

612c7ed5452daf9db949093dcdf5fdef25132412
SHA256

15a8b3b9f7b50efb9922d132759d2d3fea482074c5c7acc774d3a6a053a11c89
SHA512

01c5fda274bb104c7b774098dfa2e34ff77831067893e0144ba7bf750f84e107f83da4d5091f73b98b4ec54c5d2148299a8c6d49c00710015f3b5d19c4cf703f
SSDEEP

12288:Gg+mzUMDRUTV5nKHihTJd7BkcQc4yb28PnxcpNVVqgWxuxLA:G1/ZTV5n8ir7kcp4x6cpN/WxaLA

Score

10^/10

modiloader defense_evasion discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000019261-12.dat	modiloader_stage2
behavioral1/memory/2684-15-0x0000000000400000-0x00000000004BB000-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

pid	Process
2692	kb.exe
2684	kk.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0b327b88f123510e6b50df100ee9f50b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2692	kb.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 2912	1552	JaffaCakes118_0b327b88f123510e6b50df100ee9f50b.exe	31
PID 1552 wrote to memory of 2912	1552	JaffaCakes118_0b327b88f123510e6b50df100ee9f50b.exe	31
PID 1552 wrote to memory of 2912	1552	JaffaCakes118_0b327b88f123510e6b50df100ee9f50b.exe	31
PID 1552 wrote to memory of 2912	1552	JaffaCakes118_0b327b88f123510e6b50df100ee9f50b.exe	31
PID 2912 wrote to memory of 996	2912	WScript.exe	32
PID 2912 wrote to memory of 996	2912	WScript.exe	32
PID 2912 wrote to memory of 996	2912	WScript.exe	32
PID 2912 wrote to memory of 996	2912	WScript.exe	32
PID 2912 wrote to memory of 1628	2912	WScript.exe	34
PID 2912 wrote to memory of 1628	2912	WScript.exe	34
PID 2912 wrote to memory of 1628	2912	WScript.exe	34
PID 2912 wrote to memory of 1628	2912	WScript.exe	34
PID 2912 wrote to memory of 2312	2912	WScript.exe	36
PID 2912 wrote to memory of 2312	2912	WScript.exe	36
PID 2912 wrote to memory of 2312	2912	WScript.exe	36
PID 2912 wrote to memory of 2312	2912	WScript.exe	36
PID 2912 wrote to memory of 3060	2912	WScript.exe	38
PID 2912 wrote to memory of 3060	2912	WScript.exe	38
PID 2912 wrote to memory of 3060	2912	WScript.exe	38
PID 2912 wrote to memory of 3060	2912	WScript.exe	38
PID 2912 wrote to memory of 2616	2912	WScript.exe	40
PID 2912 wrote to memory of 2616	2912	WScript.exe	40
PID 2912 wrote to memory of 2616	2912	WScript.exe	40
PID 2912 wrote to memory of 2616	2912	WScript.exe	40
PID 996 wrote to memory of 2692	996	cmd.exe	42
PID 996 wrote to memory of 2692	996	cmd.exe	42
PID 996 wrote to memory of 2692	996	cmd.exe	42
PID 996 wrote to memory of 2692	996	cmd.exe	42
PID 1628 wrote to memory of 2684	1628	cmd.exe	43
PID 1628 wrote to memory of 2684	1628	cmd.exe	43
PID 1628 wrote to memory of 2684	1628	cmd.exe	43
PID 1628 wrote to memory of 2684	1628	cmd.exe	43

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b327b88f123510e6b50df100ee9f50b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b327b88f123510e6b50df100ee9f50b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\s.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c kb
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\kb.exe
      kb
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2692
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c kk.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\kk.exe
      kk.exe
      4⤵
      Executes dropped EXE
      PID:2684
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del kb.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2312
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del k.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3060
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c del s.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\kb.exe

Filesize
51KB

MD5
4665d7a9c72f59046c4b1513b19d4e15

SHA1
0bdfedde3ec7a10936ce6202ae3e81b03f1b2b5e

SHA256
31e384fe60859e455eddd5b603b4aec8020724b43d1a0a32218a75f77e281833

SHA512
ef4100b05190fedcbd777669ef2415f39adace40d418d93e19a75959f68553974e9bf3011c07ee37b7346ae059e4e73b0cc795d4305c5f17662769891347d54a

Download Submit
C:\kk.exe

Filesize
680KB

MD5
7772fb976ceb942e8fb8639bc93261ef

SHA1
c29fe0b3c0fe88acb3de01f020b19aa3e0b22f07

SHA256
125438081c49842f4e226e979c38a7da5780d43ad410b064fc3ab8c731400680

SHA512
a6645660657d9ca5768a5a6a4aa423269fba0160169efedac28156101991294688ff9ffc1195c122221fc335afcf36beef8087f90e2f36824c55114d6f1119e1

Download Submit
C:\s.vbs

Filesize
198B

MD5
0106cd0e268e3234cd2b3567b2f30d75

SHA1
01f9134f8ad1693aadff6df1bab7718b875aa15a

SHA256
e84d10954519e536322c9c0dd8e3ae01c9ae05744b18221bb7eadfe8d7b6967d

SHA512
8637f3abb04d8f1cd5ea65d0bf8cefe61ecf7f37c34901f5292a87a612285f03dac713f6d1f268b7c5bb65bf5fe3e6816b12892c4d528133afd22e7ba2eca42e

Download Submit
memory/1552-16-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1628-13-0x0000000002240000-0x00000000022FB000-memory.dmp

Filesize
748KB

Download
memory/1628-14-0x0000000002240000-0x00000000022FB000-memory.dmp

Filesize
748KB

Download
memory/2684-15-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download