modiloader | 02eec1ece09e3616154bfa0fb1a208a0957ec0c2c167c47e608eec6ed8bf1df4

Analysis

max time kernel
142s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe
Size

2.1MB
MD5

19a0876cca42891bdcbe4bd372d6d81d
SHA1

abc7a32884285a3350478179386f8debb3c0e6b6
SHA256

02eec1ece09e3616154bfa0fb1a208a0957ec0c2c167c47e608eec6ed8bf1df4
SHA512

16569ef43bf7a7dda340a35fd3c1eb82f3f96d5f50886ef4de1d21e2d577d78a3b415fc6cd64df38d572f7c59e37700bf85d0a5ed74971465989f3ea7b45fba7
SSDEEP

24576:jYh9Ib+x95Yenfvr/Br3fTN9fzpstmH4kWqkSZvJpKkeHw8jHXrlrSklrxVoppCQ:s3IU9hzx59bcCdlBc/H9SkSprtZrCyt

Score

10^/10

modiloader evasion themida trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 11 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2880-6-0x0000000000400000-0x0000000000611000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-5-0x0000000000401000-0x00000000004AF000-memory.dmp	modiloader_stage2
behavioral1/memory/2792-19-0x0000000000400000-0x0000000000611000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-23-0x0000000000400000-0x0000000000611000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-24-0x0000000000400000-0x0000000000611000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-27-0x0000000000401000-0x00000000004AF000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-28-0x0000000000400000-0x0000000000611000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-30-0x0000000000400000-0x0000000000611000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-32-0x0000000000400000-0x0000000000611000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-40-0x0000000000400000-0x0000000000611000-memory.dmp	modiloader_stage2
behavioral1/memory/2880-41-0x0000000000401000-0x00000000004AF000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1676 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

rejoice47.exe

pid process

2792 rejoice47.exe

pid	process
1676	cmd.exe

pid	process
2792	rejoice47.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exerejoice47.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Wine	19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Wine	rejoice47.exe

Loads dropped DLL 5 IoCs

Processes:

19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exeWerFault.exe

pid process

2880 19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe
2880 19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe
2576 WerFault.exe
2576 WerFault.exe
2576 WerFault.exe

pid	process
2880	19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe
2880	19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe

Themida packer 14 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/2880-0-0x0000000000400000-0x0000000000611000-memory.dmp	themida
behavioral1/memory/2880-6-0x0000000000400000-0x0000000000611000-memory.dmp	themida
\Program Files\Common Files\Microsoft Shared\MSInfo\rejoice47.exe	themida
behavioral1/memory/2880-9-0x0000000005810000-0x0000000005A21000-memory.dmp	themida
behavioral1/memory/2792-16-0x0000000000400000-0x0000000000611000-memory.dmp	themida
behavioral1/memory/2792-17-0x0000000000400000-0x0000000000611000-memory.dmp	themida
behavioral1/memory/2792-18-0x0000000000400000-0x0000000000611000-memory.dmp	themida
behavioral1/memory/2792-19-0x0000000000400000-0x0000000000611000-memory.dmp	themida
behavioral1/memory/2880-23-0x0000000000400000-0x0000000000611000-memory.dmp	themida
behavioral1/memory/2880-24-0x0000000000400000-0x0000000000611000-memory.dmp	themida
behavioral1/memory/2880-28-0x0000000000400000-0x0000000000611000-memory.dmp	themida
behavioral1/memory/2880-30-0x0000000000400000-0x0000000000611000-memory.dmp	themida
behavioral1/memory/2880-32-0x0000000000400000-0x0000000000611000-memory.dmp	themida
behavioral1/memory/2880-40-0x0000000000400000-0x0000000000611000-memory.dmp	themida

Drops file in Program Files directory 3 IoCs

Processes:

19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe	19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe	19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupDel.bat	19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2576 2792 WerFault.exe rejoice47.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exerejoice47.exe

pid process

2880 19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe
2792 rejoice47.exe

pid	pid_target	process	target process
2576	2792	WerFault.exe	rejoice47.exe

pid	process
2880	19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe
2792	rejoice47.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exerejoice47.exe

description	pid	process	target process
PID 2880 wrote to memory of 2792	2880	19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe	rejoice47.exe
PID 2880 wrote to memory of 2792	2880	19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe	rejoice47.exe
PID 2880 wrote to memory of 2792	2880	19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe	rejoice47.exe
PID 2880 wrote to memory of 2792	2880	19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe	rejoice47.exe
PID 2792 wrote to memory of 2576	2792	rejoice47.exe	WerFault.exe
PID 2792 wrote to memory of 2576	2792	rejoice47.exe	WerFault.exe
PID 2792 wrote to memory of 2576	2792	rejoice47.exe	WerFault.exe
PID 2792 wrote to memory of 2576	2792	rejoice47.exe	WerFault.exe
PID 2880 wrote to memory of 1676	2880	19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe	cmd.exe
PID 2880 wrote to memory of 1676	2880	19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe	cmd.exe
PID 2880 wrote to memory of 1676	2880	19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe	cmd.exe
PID 2880 wrote to memory of 1676	2880	19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe	cmd.exe
PID 2880 wrote to memory of 1676	2880	19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe	cmd.exe
PID 2880 wrote to memory of 1676	2880	19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe	cmd.exe
PID 2880 wrote to memory of 1676	2880	19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\19a0876cca42891bdcbe4bd372d6d81d_JaffaCakes118.exe"
1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2880

C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe
"C:\Program Files\Common Files\Microsoft Shared\MSINFO\rejoice47.exe"
2⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 460
3⤵
- Loads dropped DLL
- Program crash
PID:2576

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupDel.bat""
2⤵
- Deletes itself
PID:1676

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSInfo\SetupDel.bat
Filesize
212B

MD5
e0dc9bebd4e8b7fe7bc75a7a34849534

SHA1
a012dee11de92ef384a837fb59d9b3cdbeba86d3

SHA256
52841e8af6f3b27ed49ca4c6d9ee15e84d27df5aef38eefb3a11919270aa1f1b

SHA512
4d05443c4680fdc1f45294eac296014c22493549d4836a13e2a41aa6d4480c0e3e51eff9fd29f74b2cf5326138f928f6edd829381e091e9a37fdfbf4b67e440b

Download Submit
\Program Files\Common Files\Microsoft Shared\MSInfo\rejoice47.exe
Filesize
2.1MB

MD5
19a0876cca42891bdcbe4bd372d6d81d

SHA1
abc7a32884285a3350478179386f8debb3c0e6b6

SHA256
02eec1ece09e3616154bfa0fb1a208a0957ec0c2c167c47e608eec6ed8bf1df4

SHA512
16569ef43bf7a7dda340a35fd3c1eb82f3f96d5f50886ef4de1d21e2d577d78a3b415fc6cd64df38d572f7c59e37700bf85d0a5ed74971465989f3ea7b45fba7

Download Submit
memory/2792-18-0x0000000000400000-0x0000000000611000-memory.dmp

Filesize
2.1MB

Download
memory/2792-16-0x0000000000400000-0x0000000000611000-memory.dmp

Filesize
2.1MB

Download
memory/2792-19-0x0000000000400000-0x0000000000611000-memory.dmp

Filesize
2.1MB

Download
memory/2792-17-0x0000000000400000-0x0000000000611000-memory.dmp

Filesize
2.1MB

Download
memory/2880-24-0x0000000000400000-0x0000000000611000-memory.dmp

Filesize
2.1MB

Download
memory/2880-27-0x0000000000401000-0x00000000004AF000-memory.dmp

Filesize
696KB

Download
memory/2880-9-0x0000000005810000-0x0000000005A21000-memory.dmp

Filesize
2.1MB

Download
memory/2880-2-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2880-0-0x0000000000400000-0x0000000000611000-memory.dmp

Filesize
2.1MB

Download
memory/2880-5-0x0000000000401000-0x00000000004AF000-memory.dmp

Filesize
696KB

Download
memory/2880-23-0x0000000000400000-0x0000000000611000-memory.dmp

Filesize
2.1MB

Download
memory/2880-6-0x0000000000400000-0x0000000000611000-memory.dmp

Filesize
2.1MB

Download
memory/2880-26-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2880-15-0x0000000005810000-0x0000000005A21000-memory.dmp

Filesize
2.1MB

Download
memory/2880-28-0x0000000000400000-0x0000000000611000-memory.dmp

Filesize
2.1MB

Download
memory/2880-29-0x0000000005810000-0x0000000005A21000-memory.dmp

Filesize
2.1MB

Download
memory/2880-30-0x0000000000400000-0x0000000000611000-memory.dmp

Filesize
2.1MB

Download
memory/2880-32-0x0000000000400000-0x0000000000611000-memory.dmp

Filesize
2.1MB

Download
memory/2880-1-0x0000000001F00000-0x0000000001FFD000-memory.dmp

Filesize
1012KB

Download
memory/2880-40-0x0000000000400000-0x0000000000611000-memory.dmp

Filesize
2.1MB

Download
memory/2880-41-0x0000000000401000-0x00000000004AF000-memory.dmp

Filesize
696KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads