modiloader | 29ae9ace722eed00b7d827fe7d3ce03e7c506e9253011da9eda468ccffaa050e

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/03/2025, 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9851f67b2aa7f8c80adf5addd00a5ab8.exe
Size

829KB
MD5

9851f67b2aa7f8c80adf5addd00a5ab8
SHA1

399b53bd63ccf2ff9c292bea0ebd56953c3bee0f
SHA256

29ae9ace722eed00b7d827fe7d3ce03e7c506e9253011da9eda468ccffaa050e
SHA512

721d032fb42aa0875513d21fa6bfa9aa112fcfb7da1c013305094d831bcecf56bf3bb602095ef3f051966283635f18e88d35883b2f3bdeaa1746d28d929cbae2
SSDEEP

24576:z5AOz0veUQTXENjA0lLHCkv2up3g37LQ2u0:z5AO9XwXl+3vQv0

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 3 IoCs

resource	yara_rule
behavioral1/files/0x0008000000015cfd-6.dat	modiloader_stage2
behavioral1/memory/1476-14-0x0000000000400000-0x00000000004D7000-memory.dmp	modiloader_stage2
behavioral1/memory/1628-22-0x0000000000400000-0x00000000004D7000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
2520	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1476	YYServer.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\YYServer.exe	JaffaCakes118_9851f67b2aa7f8c80adf5addd00a5ab8.exe
File opened for modification	C:\Windows\SysWOW64\YYServer.exe	JaffaCakes118_9851f67b2aa7f8c80adf5addd00a5ab8.exe
File created	C:\Windows\SysWOW64\YYServer.exe_	YYServer.exe
File opened for modification	C:\Windows\SysWOW64\YYServer.exe_	YYServer.exe
File opened for modification	C:\Windows\SysWOW64\YYServer.exe	YYServer.exe
File created	C:\Windows\SysWOW64\Deleteme.bat	JaffaCakes118_9851f67b2aa7f8c80adf5addd00a5ab8.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9851f67b2aa7f8c80adf5addd00a5ab8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YYServer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1628	JaffaCakes118_9851f67b2aa7f8c80adf5addd00a5ab8.exe
1476	YYServer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2520	1628	JaffaCakes118_9851f67b2aa7f8c80adf5addd00a5ab8.exe	31
PID 1628 wrote to memory of 2520	1628	JaffaCakes118_9851f67b2aa7f8c80adf5addd00a5ab8.exe	31
PID 1628 wrote to memory of 2520	1628	JaffaCakes118_9851f67b2aa7f8c80adf5addd00a5ab8.exe	31
PID 1628 wrote to memory of 2520	1628	JaffaCakes118_9851f67b2aa7f8c80adf5addd00a5ab8.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9851f67b2aa7f8c80adf5addd00a5ab8.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9851f67b2aa7f8c80adf5addd00a5ab8.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\Deleteme.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2520

C:\Windows\SysWOW64\YYServer.exe
C:\Windows\SysWOW64\YYServer.exe -Service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Deleteme.bat

Filesize
100B

MD5
73b4e365bf4bd541015e0bedb06df862

SHA1
b7a746c29f75a44ad54f7880b07d0bda728afd18

SHA256
f3d784aab9aa8135df87cf6e7917fbb5735f929b075237b685a373c6b6c8d0a2

SHA512
0397889852e28615611c62763118f182b3b5c7c7a9fa60d4a8ac0419de61367665ca9c53b5832f3fce416f3f7b8209a2908d9f5d1bf9a1a544b674997023b68e

Download Submit
C:\Windows\SysWOW64\YYServer.exe

Filesize
829KB

MD5
9851f67b2aa7f8c80adf5addd00a5ab8

SHA1
399b53bd63ccf2ff9c292bea0ebd56953c3bee0f

SHA256
29ae9ace722eed00b7d827fe7d3ce03e7c506e9253011da9eda468ccffaa050e

SHA512
721d032fb42aa0875513d21fa6bfa9aa112fcfb7da1c013305094d831bcecf56bf3bb602095ef3f051966283635f18e88d35883b2f3bdeaa1746d28d929cbae2

Download Submit
memory/1476-8-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1476-14-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/1628-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1628-22-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download