modiloader | 02ea40c6e298371e21888c2ba5a519a69a1e0b58a06ea4a70de0732e45ed0ad2

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a31a98075704380eeff6383c9b69aed_JaffaCakes118.exe
Size

128KB
MD5

1a31a98075704380eeff6383c9b69aed
SHA1

38625429e7fcd5c56bc6de606c82ccf966b31293
SHA256

02ea40c6e298371e21888c2ba5a519a69a1e0b58a06ea4a70de0732e45ed0ad2
SHA512

3441f933bb6baf7949684ad0d6ee421bdbc684be0b0ca7faef72aaca754458289e5bd21d3a8068faa750782c393a339fc26c07877a057434f68b15c3be0696cf
SSDEEP

3072:M1cAIPWSxIkwx6+/+ZwzmR9Xtj1ihwz9UmqM+DX32whuP83hV:UcZjxIz6+/+ZwzGnWwG9hnBg0xV

Score

10^/10

modiloader evasion trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
ModiLoader Second Stage 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4548-19-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

1a31a98075704380eeff6383c9b69aed_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 1a31a98075704380eeff6383c9b69aed_JaffaCakes118.exe
Executes dropped EXE 1 IoCs

Processes:

Crypted.exe

pid process

4548 Crypted.exe

resource	yara_rule
behavioral2/memory/4548-19-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	1a31a98075704380eeff6383c9b69aed_JaffaCakes118.exe

pid	process
4548	Crypted.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Crypted.exe	upx
behavioral2/memory/4548-16-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/4548-19-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Crypted.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Crypted.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Crypted.exe

description pid process

Token: SeDebugPrivilege 4548 Crypted.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Crypted.exe

pid process

4548 Crypted.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Crypted.exe

description	pid	process
Token: SeDebugPrivilege	4548	Crypted.exe

pid	process
4548	Crypted.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1a31a98075704380eeff6383c9b69aed_JaffaCakes118.exe

description	pid	process	target process
PID 4632 wrote to memory of 4548	4632	1a31a98075704380eeff6383c9b69aed_JaffaCakes118.exe	Crypted.exe
PID 4632 wrote to memory of 4548	4632	1a31a98075704380eeff6383c9b69aed_JaffaCakes118.exe	Crypted.exe
PID 4632 wrote to memory of 4548	4632	1a31a98075704380eeff6383c9b69aed_JaffaCakes118.exe	Crypted.exe

C:\Users\Admin\AppData\Local\Temp\1a31a98075704380eeff6383c9b69aed_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a31a98075704380eeff6383c9b69aed_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4632

C:\Users\Admin\AppData\Local\Temp\Crypted.exe
"C:\Users\Admin\AppData\Local\Temp\Crypted.exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4548

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Crypted.exe
Filesize
111KB

MD5
f262d3f3b80858f8b352c2798d6e2035

SHA1
3886f0b52a1df1d6517f1c104bc4cc6b5780f63b

SHA256
a73e8c8d03735d3b87f04d667636e150b15a75e9b6e1083480f66b1e7ad45c9e

SHA512
a0d9dadbe11c7a3a79b2210f50cb2b0466883b3f3b5b9b18ca4a1c3582938d71c34b9b18431f0a1046a013aec510f9bbf5e6430cb4c0c986ae05c21dfe333634

Download Submit
memory/4548-16-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4548-19-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4632-0-0x00007FF89E195000-0x00007FF89E196000-memory.dmp

Filesize
4KB

Download
memory/4632-1-0x000000001B730000-0x000000001B7D6000-memory.dmp

Filesize
664KB

Download
memory/4632-2-0x00007FF89DEE0000-0x00007FF89E881000-memory.dmp

Filesize
9.6MB

Download
memory/4632-3-0x000000001BD70000-0x000000001C23E000-memory.dmp

Filesize
4.8MB

Download
memory/4632-4-0x000000001C2E0000-0x000000001C37C000-memory.dmp

Filesize
624KB

Download
memory/4632-5-0x00007FF89DEE0000-0x00007FF89E881000-memory.dmp

Filesize
9.6MB

Download
memory/4632-6-0x0000000001320000-0x0000000001328000-memory.dmp

Filesize
32KB

Download
memory/4632-7-0x000000001C470000-0x000000001C4BC000-memory.dmp

Filesize
304KB

Download
memory/4632-18-0x00007FF89DEE0000-0x00007FF89E881000-memory.dmp

Filesize
9.6MB

Download