modiloader | 90260fb517aef90268e0f95a4cfef939887f5acbd9448b2a291a93e65d13c1cb

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe
Size

181KB
MD5

19a049119999ce6179a6f2c7f1bc2cc3
SHA1

9d69bfb8c0522f626dac62a2642b6488af30da41
SHA256

90260fb517aef90268e0f95a4cfef939887f5acbd9448b2a291a93e65d13c1cb
SHA512

8d6e9e2026ec4f57f16dee83ab2b0cdeb7cf4c5acc8e1c1a17824555c0855dc16313f79ef0887f341d13df664978baa06d7f96fe087b5ea5c668431d12244de0
SSDEEP

3072:bLH3Qp/pHocucy4+qpbHiNeC2uEtcBVdI243cG1plubZCpg9CEP9o2ullx5cK5w:v6IcwTqpbiNeC3I/m8oCEyZlaKy

Score

10^/10

modiloader evasion persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe

ModiLoader Second Stage 4 IoCs

Processes:

resource	yara_rule
C:\Windows\sm57ger.dll	modiloader_stage2
behavioral1/memory/2364-11-0x0000000001EE0000-0x0000000001F3E000-memory.dmp	modiloader_stage2
behavioral1/memory/2364-17-0x0000000000400000-0x000000000049E000-memory.dmp	modiloader_stage2
behavioral1/memory/2364-18-0x0000000001EE0000-0x0000000001F3E000-memory.dmp	modiloader_stage2

Drops file in Drivers directory 1 IoCs

Processes:

19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Drivers\beep.sys 19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

3000 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe

pid process

2364 19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Drivers\beep.sys	19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe

pid	process
3000	cmd.exe

pid	process
2364	19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\notify\sm57ger\StartShell = "test"	19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\notify\sm57ger\Impersonate = "0"	19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\notify\sm57ger\Asynchronous = "0"	19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\notify\sm57ger	19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\notify	19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\notify\sm57ger	19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\notify\sm57ger\DllName = "C:\\Windows\\sm57ger.dll"	19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

Processes:

19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\sm57ger.dll	19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe
File opened for modification	C:\Windows\sm57ger.dll	19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe

pid process

2364 19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe
2364 19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

480

pid	process
2364	19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe
2364	19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe

pid	process
480

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe

description	pid	process	target process
PID 2364 wrote to memory of 3000	2364	19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe	cmd.exe
PID 2364 wrote to memory of 3000	2364	19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe	cmd.exe
PID 2364 wrote to memory of 3000	2364	19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe	cmd.exe
PID 2364 wrote to memory of 3000	2364	19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Drops file in Drivers directory
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2364

C:\Windows\SysWOW64\cmd.exe
cmd /c del "C:\Users\Admin\AppData\Local\Temp\19a049119999ce6179a6f2c7f1bc2cc3_JaffaCakes118.exe"
2⤵
- Deletes itself
PID:3000

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\sm57ger.dll
Filesize
364KB

MD5
e74502b78d71bc26e4150dc4a69ba1a9

SHA1
4dc12863415c4bef48283d3e43976420b247518b

SHA256
b93de88032e340f3ac8ae14de55d7566a932bcb7ad9e28f87693fe80fb8a802c

SHA512
ce87f36a0d9bc4a88023f19daebf3bce12b5b18dd06bb279ce707109e3dca80457097e9c482f369c358ac842fa5aab6e9158c59cf958fc3354e54e6f1f0fe755

Download Submit
\Users\Admin\AppData\Local\Temp\Ress.dll
Filesize
8KB

MD5
289c522931bf09786bd7a02c5d3165cb

SHA1
0100097d05e357bb9fab4db4dd7c5bc2bad1419f

SHA256
1dceb50ed8cfd3942566fc9612f9534308d787ab40405bd4d42b0b91ce31f9a6

SHA512
dc7f890de10835df102249c6f49c6177081ff5e3f3891cf747eea65ebfce5fcd644a57c8b2b1dce4fb85f429036e12abc75cfb466d1f36202af9eb7cf3c3dfaf

Download Submit
memory/2364-11-0x0000000001EE0000-0x0000000001F3E000-memory.dmp

Filesize
376KB

Download
memory/2364-17-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/2364-18-0x0000000001EE0000-0x0000000001F3E000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads