modiloader | 439278b444a423364de3a0e0a9079d146d6217921841cc3301e2063b5b723c81

Analysis

max time kernel
142s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe
Size

1.8MB
MD5

1cf98f281d0befbf029f3df689b16e91
SHA1

7619d06561921ac1da7804bc1620dcc053b7b53c
SHA256

439278b444a423364de3a0e0a9079d146d6217921841cc3301e2063b5b723c81
SHA512

e4eae31ef2a3e55df208d7137b813659e3ece7d6b338a5ac4b2c1bb90fb7a75680044b6b021a213ec26562600a45aabdf810eb4c900c6d3c0a293b333235b67c
SSDEEP

49152:808WUwulZHaKrS0DzETrT51sV+Y+sc/y2JsHHi:SDweaKrS0fEnd1sV5XcaPi

Score

10^/10

modiloader evasion trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 28 IoCs

Processes:

resource	yara_rule
behavioral2/memory/880-4-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/880-5-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/880-9-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/880-12-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/880-13-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-14-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-15-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-16-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-17-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-18-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-19-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-20-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-21-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-22-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-23-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-24-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-25-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-26-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-27-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-28-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-29-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-30-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-31-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-32-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-33-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-34-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-35-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2
behavioral2/memory/4880-36-0x0000000000400000-0x0000000002E15000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

scardsvr.exe

pid process

4880 scardsvr.exe

pid	process
4880	scardsvr.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exescardsvr.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Wine	1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Wine	scardsvr.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exescardsvr.exe

pid process

880 1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe
4880 scardsvr.exe

pid	process
880	1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe
4880	scardsvr.exe

Drops file in Windows directory 2 IoCs

Processes:

1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\scardsvr.exe	1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe
File opened for modification	C:\Windows\scardsvr.exe	1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exescardsvr.exe

pid process

880 1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe
880 1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe
4880 scardsvr.exe
4880 scardsvr.exe

pid	process
880	1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe
880	1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe
4880	scardsvr.exe
4880	scardsvr.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe

description	pid	process	target process
PID 880 wrote to memory of 4880	880	1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe	scardsvr.exe
PID 880 wrote to memory of 4880	880	1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe	scardsvr.exe
PID 880 wrote to memory of 4880	880	1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe	scardsvr.exe
PID 880 wrote to memory of 2296	880	1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe	cmd.exe
PID 880 wrote to memory of 2296	880	1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe	cmd.exe
PID 880 wrote to memory of 2296	880	1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe"
1⤵
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:880

C:\Windows\scardsvr.exe
C:\Windows\scardsvr.exe
2⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4880

C:\Windows\SysWOW64\cmd.exe
cmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\1cf98f281d0befbf029f3df689b16e91_JaffaCakes118.exe"
2⤵
PID:2296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4172,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=1036 /prefetch:8
1⤵
PID:3060

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\scardsvr.exe
Filesize
1.8MB

MD5
1cf98f281d0befbf029f3df689b16e91

SHA1
7619d06561921ac1da7804bc1620dcc053b7b53c

SHA256
439278b444a423364de3a0e0a9079d146d6217921841cc3301e2063b5b723c81

SHA512
e4eae31ef2a3e55df208d7137b813659e3ece7d6b338a5ac4b2c1bb90fb7a75680044b6b021a213ec26562600a45aabdf810eb4c900c6d3c0a293b333235b67c

Download Submit
memory/880-0-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/880-1-0x0000000000401000-0x0000000000452000-memory.dmp

Filesize
324KB

Download
memory/880-4-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/880-5-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/880-9-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/880-11-0x0000000000401000-0x0000000000452000-memory.dmp

Filesize
324KB

Download
memory/880-12-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/880-13-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-21-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-25-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-16-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-17-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-18-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-19-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-20-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-14-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-22-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-23-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-24-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-15-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-26-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-27-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-28-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-29-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-30-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-31-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-32-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-33-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-34-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-35-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download
memory/4880-36-0x0000000000400000-0x0000000002E15000-memory.dmp

Filesize
42.1MB

Download