modiloader | e8451025d4603a2a8d21da805872c8cc969d60b58348cc18e78d8f6fda630d7f

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exe
Size

161KB
MD5

1843a135d94f1cbc00e6bb3fd4db51ee
SHA1

7121e6d20636e9d106667d259dceffecf9c62cea
SHA256

e8451025d4603a2a8d21da805872c8cc969d60b58348cc18e78d8f6fda630d7f
SHA512

b783e5d809264771b9bee22dcee124116be89f762b5042463030132e2d94157eafa9edde142bb8591c3123d06a3282e08b52d673ccfe349ed2c168e3787a63d9
SSDEEP

3072:S1vQVRuPwAYps/VkzceOyIMziq/HO9hBJEE7/f4hMCpnNmjWTf:6QHpsdicenOTxJEI/fyzpNmjof

Score

10^/10

modiloader evasion trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

asd.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" asd.exe

ModiLoader Second Stage 15 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1076-28-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1076-31-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1076-32-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1076-37-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1076-40-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1076-43-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1076-47-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1076-50-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1076-53-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1076-56-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1076-59-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1076-62-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1076-65-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1076-68-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1076-71-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

asd.exe

pid process

1076 asd.exe
Loads dropped DLL 5 IoCs

Processes:

1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exeasd.exe

pid process

3000 1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exe
3000 1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exe
1076 asd.exe
1076 asd.exe
3000 1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exe

pid	process
1076	asd.exe

pid	process
3000	1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exe
3000	1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exe
1076	asd.exe
1076	asd.exe
3000	1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\bqkWSm\asd.exe	upx
behavioral1/memory/3000-9-0x0000000001BB0000-0x0000000001C00000-memory.dmp	upx
behavioral1/memory/1076-12-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1076-28-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1076-31-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1076-32-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1076-37-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1076-40-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1076-43-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1076-47-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1076-50-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1076-53-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1076-56-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1076-59-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1076-62-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1076-65-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1076-68-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1076-71-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

asd.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	asd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	asd.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

asd.exevssvc.exe1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1076	asd.exe
Token: SeBackupPrivilege	3068	vssvc.exe
Token: SeRestorePrivilege	3068	vssvc.exe
Token: SeAuditPrivilege	3068	vssvc.exe
Token: SeDebugPrivilege	1076	asd.exe
Token: SeDebugPrivilege	3000	1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exeasd.exe

pid process

3000 1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exe
1076 asd.exe
1076 asd.exe

pid	process
3000	1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exe
1076	asd.exe
1076	asd.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exe

description	pid	process	target process
PID 3000 wrote to memory of 1076	3000	1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exe	asd.exe
PID 3000 wrote to memory of 1076	3000	1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exe	asd.exe
PID 3000 wrote to memory of 1076	3000	1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exe	asd.exe
PID 3000 wrote to memory of 1076	3000	1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exe	asd.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

asd.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" asd.exe
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1843a135d94f1cbc00e6bb3fd4db51ee_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000

C:\Users\Admin\AppData\Local\Temp\bqkWSm\asd.exe
"C:\Users\Admin\AppData\Local\Temp\\bqkWSm\asd.exe"
2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1076

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3068

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\bqkWSm\asd.exe
Filesize
108KB

MD5
7f1180d673d05b9f8d23d73e7db0fc1c

SHA1
733ef7cfc583432db6d84af46c591e115a6af7d9

SHA256
74fb40e58af389ffc02b7347a9f0588acbd2976a09231c67f4b7d7e311181290

SHA512
856008b4d0cc2330c48492b9ef682cc05d98ae1bd0b3104bfb616105913f9045c37ebd8f2d81f067c86168549b583198adc094232e2f5efb2008379786b3b1f4

Download Submit
\Users\Admin\AppData\Local\Temp\bqkWSm\cmsetac.dll
Filesize
32KB

MD5
a03d1366d55298b1e8a6c99e79a8bf1f

SHA1
2e631e58afbb1da632346ebc4e69a4865d8cf616

SHA256
02c2f8ced89e86e421641a89baf85401597bcac1d029377287fa33e0a9513c25

SHA512
88f5f91e461ac8076e7b3934f3bebf97ca95b222099a7d11dd985fa0a2291a49958cf3950817cf513065f673e26c8102db461a53136b09a5d7f09b56fcc0e7b7

Download Submit
\Users\Admin\AppData\Local\Temp\bqkWSm\ntdtcstp.dll
Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
memory/1076-50-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1076-19-0x00000000004C0000-0x00000000004CE000-memory.dmp

Filesize
56KB

Download
memory/1076-32-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1076-71-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1076-35-0x0000000076F00000-0x0000000076FF0000-memory.dmp

Filesize
960KB

Download
memory/1076-68-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1076-24-0x0000000076F10000-0x0000000076F11000-memory.dmp

Filesize
4KB

Download
memory/1076-65-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1076-27-0x0000000076F00000-0x0000000076FF0000-memory.dmp

Filesize
960KB

Download
memory/1076-26-0x0000000076F00000-0x0000000076FF0000-memory.dmp

Filesize
960KB

Download
memory/1076-28-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1076-36-0x0000000076F00000-0x0000000076FF0000-memory.dmp

Filesize
960KB

Download
memory/1076-30-0x00000000004C0000-0x00000000004CE000-memory.dmp

Filesize
56KB

Download
memory/1076-31-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1076-17-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1076-12-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1076-29-0x0000000000330000-0x0000000000338000-memory.dmp

Filesize
32KB

Download
memory/1076-37-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1076-40-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1076-43-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1076-47-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1076-62-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1076-53-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1076-56-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1076-59-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3000-9-0x0000000001BB0000-0x0000000001C00000-memory.dmp

Filesize
320KB

Download
memory/3000-25-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download
memory/3000-23-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download
memory/3000-11-0x0000000001BB0000-0x0000000001C00000-memory.dmp

Filesize
320KB

Download