modiloader | 1bf610a3b24c3e24971ec480028971474c74721d8d5dd4c75d34b5d482260630

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 09:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
Size

671KB
MD5

1ac08f4c72120c70f805ff7d8db5088a
SHA1

0d68b32ba08cfc60a53f91c6d169bd5956d3bc98
SHA256

1bf610a3b24c3e24971ec480028971474c74721d8d5dd4c75d34b5d482260630
SHA512

ddc28acd248b51e3c6c8925fc2c0dc487872dc991c70ae921c401f6ac6d2927acc2bba8f92b538e70927064a237ec23cf1423cadadfec97fe811f7f2952f8b1e
SSDEEP

12288:UrnItzSwZk14r5uT1j5EHnoH6FT+BCj4zcrg1c2obY7n/uLf7vK:Urn0Sw+muT9Ms6FTaCjprSocT/uvvK

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4888-65-0x0000000000400000-0x0000000000579000-memory.dmp	modiloader_stage2
behavioral2/memory/4888-76-0x0000000000400000-0x0000000000579000-memory.dmp	modiloader_stage2
behavioral2/memory/1188-78-0x0000000000400000-0x0000000000579000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

Servers.exe

pid process

1188 Servers.exe

pid	process
1188	Servers.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\W:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\Z:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\G:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\I:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\M:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\N:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\O:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\Q:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\S:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\U:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\E:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\L:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\X:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\R:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\T:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\A:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\B:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\K:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\P:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\V:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\Y:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\H:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened (read-only)	\??\J:	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe

description	ioc	process
File created	C:\AutoRun.inf	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened for modification	C:\AutoRun.inf	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File created	F:\AutoRun.inf	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened for modification	F:\AutoRun.inf	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

Processes:

Servers.exe

description ioc process

File created C:\Windows\SysWOW64\_Servers.exe Servers.exe
File opened for modification C:\Windows\SysWOW64\_Servers.exe Servers.exe

description	ioc	process
File created	C:\Windows\SysWOW64\_Servers.exe	Servers.exe
File opened for modification	C:\Windows\SysWOW64\_Servers.exe	Servers.exe

Drops file in Windows directory 3 IoCs

Processes:

1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\Servers.exe	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File opened for modification	C:\Windows\Servers.exe	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
File created	C:\Windows\DelSvel.bat	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

1488 4888 WerFault.exe 1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
3148 1188 WerFault.exe Servers.exe
3972 1188 WerFault.exe Servers.exe

pid	pid_target	process	target process
1488	4888	WerFault.exe	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
3148	1188	WerFault.exe	Servers.exe
3972	1188	WerFault.exe	Servers.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exeServers.exe

description	pid	process	target process
PID 4888 wrote to memory of 1188	4888	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe	Servers.exe
PID 4888 wrote to memory of 1188	4888	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe	Servers.exe
PID 4888 wrote to memory of 1188	4888	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe	Servers.exe
PID 1188 wrote to memory of 384	1188	Servers.exe	IEXPLORE.EXE
PID 1188 wrote to memory of 384	1188	Servers.exe	IEXPLORE.EXE
PID 4888 wrote to memory of 4996	4888	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe	cmd.exe
PID 4888 wrote to memory of 4996	4888	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe	cmd.exe
PID 4888 wrote to memory of 4996	4888	1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1ac08f4c72120c70f805ff7d8db5088a_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 324
2⤵
- Program crash
PID:1488

C:\Windows\Servers.exe
C:\Windows\Servers.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 324
3⤵
- Program crash
PID:3148

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
3⤵
PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 684
3⤵
- Program crash
PID:3972

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\DelSvel.bat
2⤵
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4888 -ip 4888
1⤵
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1188 -ip 1188
1⤵
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1188 -ip 1188
1⤵
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:4320

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\DelSvel.bat
Filesize
212B

MD5
de6d5a8b74eb0e0f6d8b1035c90703ca

SHA1
e1a1bfd45bd3fb8691995d5bb9ec0e02731d5fa1

SHA256
9fa920e9a7d16ff22fe142d80010d689c27ab143dbc46570177488eb003f4200

SHA512
c3ef898de7a5b7d1b4cc3f667022123aca4de2fe2e9f9e802875cd8c35c0514b9843bff2a4fd2768ecbf880d5cf789c6a6abc56552f0278c2f8588fe9fc63452

Download Submit
F:\Servers.exe
Filesize
671KB

MD5
1ac08f4c72120c70f805ff7d8db5088a

SHA1
0d68b32ba08cfc60a53f91c6d169bd5956d3bc98

SHA256
1bf610a3b24c3e24971ec480028971474c74721d8d5dd4c75d34b5d482260630

SHA512
ddc28acd248b51e3c6c8925fc2c0dc487872dc991c70ae921c401f6ac6d2927acc2bba8f92b538e70927064a237ec23cf1423cadadfec97fe811f7f2952f8b1e

Download Submit
memory/1188-78-0x0000000000400000-0x0000000000579000-memory.dmp

Filesize
1.5MB

Download
memory/4888-0-0x0000000000400000-0x0000000000579000-memory.dmp

Filesize
1.5MB

Download
memory/4888-1-0x0000000000400000-0x0000000000579000-memory.dmp

Filesize
1.5MB

Download
memory/4888-2-0x0000000000720000-0x0000000000770000-memory.dmp

Filesize
320KB

Download
memory/4888-54-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-53-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-52-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-51-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-50-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-3-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/4888-49-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-48-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-47-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-46-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-45-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-44-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-43-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-42-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-41-0x0000000000400000-0x0000000000579000-memory.dmp

Filesize
1.5MB

Download
memory/4888-40-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-39-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-38-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-37-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-36-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-35-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-34-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-33-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-32-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-31-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-30-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-29-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-28-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-27-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-26-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-25-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-24-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-23-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-22-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-21-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-20-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-19-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-18-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-17-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-16-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-15-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-14-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-13-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-12-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/4888-11-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/4888-10-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/4888-9-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/4888-8-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4888-7-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/4888-6-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4888-5-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/4888-4-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/4888-65-0x0000000000400000-0x0000000000579000-memory.dmp

Filesize
1.5MB

Download
memory/4888-76-0x0000000000400000-0x0000000000579000-memory.dmp

Filesize
1.5MB

Download
memory/4888-77-0x0000000000720000-0x0000000000770000-memory.dmp

Filesize
320KB

Download