modiloader | 8d48740707ac221f6e9a3add1415df3b40acf3966770487718452067e67323a0

Analysis

max time kernel
104s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2025, 15:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9a4ccc630494b7c55326b84eb9fa2cec.exe
Size

172KB
MD5

9a4ccc630494b7c55326b84eb9fa2cec
SHA1

5300abd813bfe6424f4a26789dcdedda5e68afdc
SHA256

8d48740707ac221f6e9a3add1415df3b40acf3966770487718452067e67323a0
SHA512

9bd057af6664cea942abfbd4fa798047b7bb62ee819fa6aa727ff74c77e0edbc70806ba6791e0b8a9db596d5bae85cc8e71a6c23f3f123b48a02a698aa9b212a
SSDEEP

3072:VIw4eexOOmQJV4ospd4uYT7LCGo4/StzIAnIiywifq6O/VF2w:74eexV5JV4R3a7Lq2wIiMi6O/VF2w

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/memory/860-7-0x0000000002040000-0x0000000002063000-memory.dmp	modiloader_stage2
behavioral1/memory/860-9-0x0000000002040000-0x0000000002063000-memory.dmp	modiloader_stage2

Loads dropped DLL 2 IoCs

pid	Process
860	JaffaCakes118_9a4ccc630494b7c55326b84eb9fa2cec.exe
860	JaffaCakes118_9a4ccc630494b7c55326b84eb9fa2cec.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\atmQQ2.dll	JaffaCakes118_9a4ccc630494b7c55326b84eb9fa2cec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9a4ccc630494b7c55326b84eb9fa2cec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
860	JaffaCakes118_9a4ccc630494b7c55326b84eb9fa2cec.exe
860	JaffaCakes118_9a4ccc630494b7c55326b84eb9fa2cec.exe
860	JaffaCakes118_9a4ccc630494b7c55326b84eb9fa2cec.exe
860	JaffaCakes118_9a4ccc630494b7c55326b84eb9fa2cec.exe
860	JaffaCakes118_9a4ccc630494b7c55326b84eb9fa2cec.exe
860	JaffaCakes118_9a4ccc630494b7c55326b84eb9fa2cec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
860	JaffaCakes118_9a4ccc630494b7c55326b84eb9fa2cec.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9a4ccc630494b7c55326b84eb9fa2cec.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9a4ccc630494b7c55326b84eb9fa2cec.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\MSInfo\atmQQ2.dll

Filesize
20KB

MD5
2bd1ab040984428758fb11ee8f44d4b3

SHA1
05de9d27ad9cd6502b67cc3bbfffd716039803ec

SHA256
8ec5afe4f0fde28aac0012fa87dfc0de1b77ff0873a0ad8fb189eb4353107a43

SHA512
20fbf0b22a7ef7f2ff4c5c2940b234b477deb34ddfcdde1062db0d3cd784f72df4f7edc90c823ebedf74d6e40ddb00afa1ab374b1a37f2799584f34509fec7f0

Download Submit
memory/860-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/860-7-0x0000000002040000-0x0000000002063000-memory.dmp

Filesize
140KB

Download
memory/860-8-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/860-9-0x0000000002040000-0x0000000002063000-memory.dmp

Filesize
140KB

Download