modiloader | 6d7a05a939aa32e8b0ae68d271b4e7695a53261e5fef832d8383e6fd8eb5ca93

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1aa56bd6a61b14b8f2a2445ddb8166b0_JaffaCakes118.exe
Size

297KB
MD5

1aa56bd6a61b14b8f2a2445ddb8166b0
SHA1

6be0da4bb45c149c61aa758ef6302bc1f9825f17
SHA256

6d7a05a939aa32e8b0ae68d271b4e7695a53261e5fef832d8383e6fd8eb5ca93
SHA512

56d562292cad7b35c2e09a8a2fd90c38460ea1d69a7cf6f4c8775fc9d965e40666400515ef7a5e48082b1bf4d25ccdefc4b0c71b45b2ab17134a4ee56cc8c31a
SSDEEP

6144:JwVgfBuCF6vJBpuQiEdsgVwufvUkvKoC5BnQejdK:UCF6vJBpDvG5zv8

Score

10^/10

modiloader persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 7 IoCs

Processes:

resource	yara_rule
\??\c:\windows\SysWOW64\syst.dll	modiloader_stage2
behavioral2/memory/1456-4-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/4892-5-0x0000000000400000-0x0000000000445000-memory.dmp	modiloader_stage2
behavioral2/memory/4892-6-0x0000000000400000-0x0000000000445000-memory.dmp	modiloader_stage2
behavioral2/memory/4892-7-0x0000000000400000-0x0000000000445000-memory.dmp	modiloader_stage2
behavioral2/memory/4892-13-0x0000000000400000-0x0000000000445000-memory.dmp	modiloader_stage2
behavioral2/memory/4892-14-0x0000000000400000-0x0000000000445000-memory.dmp	modiloader_stage2

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

Processes:

1aa56bd6a61b14b8f2a2445ddb8166b0_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\netctrl\Parameters\ServiceDll = "C:\\Windows\\system32\\syst.dll"	1aa56bd6a61b14b8f2a2445ddb8166b0_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

Processes:

svchost.exe

pid process

4892 svchost.exe

pid	process
4892	svchost.exe

Drops file in System32 directory 2 IoCs

Processes:

1aa56bd6a61b14b8f2a2445ddb8166b0_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\syst.dll	1aa56bd6a61b14b8f2a2445ddb8166b0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\syst.dll	1aa56bd6a61b14b8f2a2445ddb8166b0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1aa56bd6a61b14b8f2a2445ddb8166b0_JaffaCakes118.exe

description	pid	process	target process
PID 1456 wrote to memory of 4268	1456	1aa56bd6a61b14b8f2a2445ddb8166b0_JaffaCakes118.exe	cmd.exe
PID 1456 wrote to memory of 4268	1456	1aa56bd6a61b14b8f2a2445ddb8166b0_JaffaCakes118.exe	cmd.exe
PID 1456 wrote to memory of 4268	1456	1aa56bd6a61b14b8f2a2445ddb8166b0_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\1aa56bd6a61b14b8f2a2445ddb8166b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1aa56bd6a61b14b8f2a2445ddb8166b0_JaffaCakes118.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\SysWOW64\cmd.exe
cmd /c del "C:\Users\Admin\AppData\Local\Temp\1aa56bd6a61b14b8f2a2445ddb8166b0_JaffaCakes118.exe"
2⤵
PID:4268

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k remoteservice
1⤵
- Loads dropped DLL
PID:4892

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\syst.dll
Filesize
246KB

MD5
4796fbf673b203b03e1a4a32d01f8699

SHA1
3c5446ba297475186f36d0018fa4077875ea54b7

SHA256
48689f2edf04df8ba20d7187663b6dece3b7a23980fc53d8151827f0c065160a

SHA512
4b396557107ea1e7679100910ab36a4f7e3ac7836627992a6bde435432fe8fd462c4d86f3048523061632db5cea51cb50ae98c91944bc432cbefd6ffac0cb112

Download Submit
memory/1456-4-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4892-5-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4892-6-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4892-7-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4892-13-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4892-14-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download