modiloader | 1b86fc78644e1b1979bc845ec800a891073c6dc57ecfeb4a32d966f7558d0e88

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16fbec0a5e193dbb2c3042f0e05f7c9f_JaffaCakes118.exe
Size

140KB
MD5

16fbec0a5e193dbb2c3042f0e05f7c9f
SHA1

b67fe5aec8a06cef2a2621b637f0d1eee1274d0b
SHA256

1b86fc78644e1b1979bc845ec800a891073c6dc57ecfeb4a32d966f7558d0e88
SHA512

71e75d6f9703718e046a7f85e2161e5aaced114e0dadc1bbb1c4b41f2433cb043dff2e72a709a845743882f9206e594ec9dbabe80510c9ac3d15d4c60b79c35c
SSDEEP

3072:BbAhLgJbjcvd6xEkHRSmjQd/ajoMycjhLgJbjcvd6xEkHRSmW:og9jc+EuRSmk/ac8g9jc+EuRSmW

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
ModiLoader Second Stage 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/5044-16-0x0000000000400000-0x000000000042A000-memory.dmp modiloader_stage2
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

16fbec0a5e193dbb2c3042f0e05f7c9f_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 16fbec0a5e193dbb2c3042f0e05f7c9f_JaffaCakes118.exe
Executes dropped EXE 2 IoCs

Processes:

GoogleUpdate.exezombieapocalypse.exe

pid process

2348 GoogleUpdate.exe
264 zombieapocalypse.exe

resource	yara_rule
behavioral2/memory/5044-16-0x0000000000400000-0x000000000042A000-memory.dmp	modiloader_stage2

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	16fbec0a5e193dbb2c3042f0e05f7c9f_JaffaCakes118.exe

pid	process
2348	GoogleUpdate.exe
264	zombieapocalypse.exe

Drops desktop.ini file(s) 3 IoCs

Processes:

zombieapocalypse.exeGoogleUpdate.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	zombieapocalypse.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	zombieapocalypse.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	GoogleUpdate.exe

Drops file in Windows directory 5 IoCs

Processes:

zombieapocalypse.exeGoogleUpdate.exe

description	ioc	process
File opened for modification	C:\Windows\assembly	zombieapocalypse.exe
File created	C:\Windows\assembly\Desktop.ini	zombieapocalypse.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	zombieapocalypse.exe
File opened for modification	C:\Windows\assembly	GoogleUpdate.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	GoogleUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

16fbec0a5e193dbb2c3042f0e05f7c9f_JaffaCakes118.exe

description	pid	process	target process
PID 5044 wrote to memory of 2348	5044	16fbec0a5e193dbb2c3042f0e05f7c9f_JaffaCakes118.exe	GoogleUpdate.exe
PID 5044 wrote to memory of 2348	5044	16fbec0a5e193dbb2c3042f0e05f7c9f_JaffaCakes118.exe	GoogleUpdate.exe
PID 5044 wrote to memory of 264	5044	16fbec0a5e193dbb2c3042f0e05f7c9f_JaffaCakes118.exe	zombieapocalypse.exe
PID 5044 wrote to memory of 264	5044	16fbec0a5e193dbb2c3042f0e05f7c9f_JaffaCakes118.exe	zombieapocalypse.exe

C:\Users\Admin\AppData\Local\Temp\16fbec0a5e193dbb2c3042f0e05f7c9f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\16fbec0a5e193dbb2c3042f0e05f7c9f_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5044

C:\Users\Admin\AppData\Local\Temp\GoogleUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\GoogleUpdate.exe"
2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
PID:2348

C:\Users\Admin\AppData\Local\Temp\zombieapocalypse.exe
"C:\Users\Admin\AppData\Local\Temp\zombieapocalypse.exe"
2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
PID:264

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GoogleUpdate.exe
Filesize
84KB

MD5
860fd20f3394e0ecc3ff1bacfd7797a2

SHA1
4eeb21c41e49bcdd971cabee74379bca03eeb76c

SHA256
6d7f0545ec553607950312aa3f50e25b2507f99e94b3217d6cb153fa0ad8a1c0

SHA512
a275310adf2d2e8ea41601bf8d3ed2a1ed1ec324c7a0ab43a294c81c2f3da4135f0c7ca1d63c2b4ed47c9afe8d9a57a237d64989fd0e8e6a0a4346c02a0774f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zombieapocalypse.exe
Filesize
44KB

MD5
4fa64f4d0856091cda09d7d6d68e8d89

SHA1
d1434200eed36e2ba795211a6f499d196e7160ae

SHA256
e6d40ae6101aa04ee305806b072dd8835b10682f905a0f929d7d7fefc1c82a61

SHA512
acae7e03607c0e9cc655c12072065c2eefc1bf24301f4d52346dc112d3744daafff78a8cee45a5a5ebeb21920129b6c2a696bb90b4d1f0fd84c1ca02263b70a4

Download Submit
C:\Windows\assembly\Desktop.ini
Filesize
227B

MD5
f7f759a5cd40bc52172e83486b6de404

SHA1
d74930f354a56cfd03dc91aa96d8ae9657b1ee54

SHA256
a709c2551b8818d7849d31a65446dc2f8c4cca2dcbbc5385604286f49cfdaf1c

SHA512
a50b7826bfe72506019e4b1148a214c71c6f4743c09e809ef15cd0e0223f3078b683d203200910b07b5e1e34b94f0fe516ac53527311e2943654bfceade53298

Download Submit
memory/264-32-0x000000001CBF0000-0x000000001CC8C000-memory.dmp

Filesize
624KB

Download
memory/264-34-0x00007FF8011D0000-0x00007FF801B71000-memory.dmp

Filesize
9.6MB

Download
memory/264-39-0x00007FF8011D0000-0x00007FF801B71000-memory.dmp

Filesize
9.6MB

Download
memory/264-20-0x00007FF8011D0000-0x00007FF801B71000-memory.dmp

Filesize
9.6MB

Download
memory/264-21-0x0000000001790000-0x0000000001798000-memory.dmp

Filesize
32KB

Download
memory/264-38-0x00007FF801485000-0x00007FF801486000-memory.dmp

Filesize
4KB

Download
memory/264-17-0x00007FF801485000-0x00007FF801486000-memory.dmp

Filesize
4KB

Download
memory/264-28-0x000000001BFD0000-0x000000001BFE0000-memory.dmp

Filesize
64KB

Download
memory/264-35-0x00000000017D0000-0x00000000017D8000-memory.dmp

Filesize
32KB

Download
memory/264-30-0x00007FF8011D0000-0x00007FF801B71000-memory.dmp

Filesize
9.6MB

Download
memory/264-31-0x000000001C610000-0x000000001CADE000-memory.dmp

Filesize
4.8MB

Download
memory/264-36-0x000000001CE80000-0x000000001CECC000-memory.dmp

Filesize
304KB

Download
memory/2348-18-0x00007FF8011D0000-0x00007FF801B71000-memory.dmp

Filesize
9.6MB

Download
memory/2348-33-0x00007FF8011D0000-0x00007FF801B71000-memory.dmp

Filesize
9.6MB

Download
memory/2348-29-0x000000001BEB0000-0x000000001BF56000-memory.dmp

Filesize
664KB

Download
memory/2348-37-0x00007FF8011D0000-0x00007FF801B71000-memory.dmp

Filesize
9.6MB

Download
memory/2348-27-0x00007FF8011D0000-0x00007FF801B71000-memory.dmp

Filesize
9.6MB

Download
memory/2348-19-0x00007FF8011D0000-0x00007FF801B71000-memory.dmp

Filesize
9.6MB

Download
memory/5044-16-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download