modiloader | 1965f99a51f6c5d332470babee2a88c304475daa1fecd4828eda54d6e5801547

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_1965f99a51f6c5d332470babee2a88c304475daa1fecd4828eda54d6e5801547.exe
Size 277KB
Sample260924-mn82zssfla
SHA256 1965f99a51f6c5d332470babee2a88c304475daa1fecd4828eda54d6e5801547
MD5 68622405cdffd8ffe96eb60927b0a214
SHA1 d4be98476f9d8ea5811e6ca3af8bbf11b7541140
SHA512 9460e36149c136eb0816635e2c75a180af776e2949e7662c1d5bd83b4e91627eb53930afaa41cef351248a851f0e035ea54291804aeac211c2d276197aab9a9d
SSDEEP 6144:uPe2zaf5+rIbZYJPz0DBmv0s7HJ5YGo9JZ:uz+f5+MbiADBwxDx
TLSH
T1E9545C23F1D18877D1731E7CCD1696A4A82ABF513E79345A7AE80E489B3D2D1786C2C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution modiloader persistence trojan

Malware Config

Signatures

Family: ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/4656-4-0x0000000000400000-0x000000000044A000-memory.dmp	modiloader_stage2

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\Svchosts.exe"	jaffacakes118_1965f99a51f6c5d332470babee2a88c304475daa1fecd4828eda54d6e5801547.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\WinSoft3.DLL	jaffacakes118_1965f99a51f6c5d332470babee2a88c304475daa1fecd4828eda54d6e5801547.exe
File created	C:\Windows\Deleteme.bat	jaffacakes118_1965f99a51f6c5d332470babee2a88c304475daa1fecd4828eda54d6e5801547.exe
File created	C:\Windows\Svchosts.exe	jaffacakes118_1965f99a51f6c5d332470babee2a88c304475daa1fecd4828eda54d6e5801547.exe
File opened for modification	C:\Windows\WinSoft3.DLL	jaffacakes118_1965f99a51f6c5d332470babee2a88c304475daa1fecd4828eda54d6e5801547.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4664	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_1965f99a51f6c5d332470babee2a88c304475daa1fecd4828eda54d6e5801547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4656	jaffacakes118_1965f99a51f6c5d332470babee2a88c304475daa1fecd4828eda54d6e5801547.exe
4656	jaffacakes118_1965f99a51f6c5d332470babee2a88c304475daa1fecd4828eda54d6e5801547.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4392	4656	jaffacakes118_1965f99a51f6c5d332470babee2a88c304475daa1fecd4828eda54d6e5801547.exe	81
PID 4656 wrote to memory of 4664	4656	jaffacakes118_1965f99a51f6c5d332470babee2a88c304475daa1fecd4828eda54d6e5801547.exe	89

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4392
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1965f99a51f6c5d332470babee2a88c304475daa1fecd4828eda54d6e5801547.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1965f99a51f6c5d332470babee2a88c304475daa1fecd4828eda54d6e5801547.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\Deleteme.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Deleteme.bat

Path C:\Windows\Deleteme.bat
Size 276B
SHA256 dbcc22bbf04bc2c2e8e62ce1d60c2503e002a636caf9616afdcf6d656e119000
MD5 5010e33631cd2812924bf14401d23158
SHA1 925262f695b247fb36a70823a5670ba8931113a6
SHA512 cb06104aa4003c8c890bb3be7a784b936faa52145e862c2e5e1c4dfb66e6fc1b56bbab6296992d567ee208a78f29c53912215349f91e07241c60925adbcaa7b7
TLSH
T119D02B54C0756DAD4808C4CF07240D0982972EC73ED81F256E6351CD314316DF1C3708
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4656-4-0x0000000000400000-0x000000000044A000-memory.dmp

Download