modiloader | 2a0869fd9b64ece60bce02fb856d9d113ca5f5740a06db06264ccf9375723403

Analysis

max time kernel
91s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe
Size 141KB
Sample240409-fyahvaff22
SHA256 2a0869fd9b64ece60bce02fb856d9d113ca5f5740a06db06264ccf9375723403
MD5 e94e3b8e51032773f456ea39a5135cf8
SHA1 0d0574d3713364be46f96f6ace785b52d71e779f
SHA512 8682ada3702a406812dfef04ca0d9b4fbe6380b65f30826c4ba957a75a9c9f6fd21e8e5aa16c79f3ebd37c9a80d45fc773d52ef5d722c626935deb12c5e89206
SSDEEP 3072:Eh8YRHE5GsBZCu9MxOLMJN9BwFWv6S+iJuo2:e8C0GAZCvach5v6S+A2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/2916-2-0x0000000020000000-0x0000000020028000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2916 set thread context of 3468	2916	e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe	94
PID 3468 set thread context of 4964	3468	e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe	97

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5028	4964	WerFault.exe	97

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 3468	2916	e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe	94
PID 2916 wrote to memory of 3468	2916	e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe	94
PID 2916 wrote to memory of 3468	2916	e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe	94
PID 2916 wrote to memory of 3468	2916	e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe	94
PID 2916 wrote to memory of 3468	2916	e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe	94
PID 3468 wrote to memory of 4964	3468	e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe	97
PID 3468 wrote to memory of 4964	3468	e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe	97
PID 3468 wrote to memory of 4964	3468	e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe	97
PID 3468 wrote to memory of 4964	3468	e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe	97
PID 3468 wrote to memory of 4964	3468	e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe	97
PID 3468 wrote to memory of 4964	3468	e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe	97
PID 3468 wrote to memory of 4964	3468	e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe	97

C:\Users\Admin\AppData\Local\Temp\e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Users\Admin\AppData\Local\Temp\e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e94e3b8e51032773f456ea39a5135cf8_JaffaCakes118.exe"
    3⤵
    PID:4964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 12
      4⤵
      Program crash
      PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 4964 -ip 4964
1⤵
PID:2248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2916-0-0x0000000020000000-0x0000000020028000-memory.dmp

Download

memory/2916-2-0x0000000020000000-0x0000000020028000-memory.dmp

Download

memory/3468-1-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/3468-3-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/3468-4-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/3468-5-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/3468-9-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4964-7-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4964-6-0x0000000000400000-0x0000000000405000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads