modiloader | 3f5edbd50b257e54f2d118d729920f99cab56c83dfb57c8977e19a50825bf527

Analysis

max time kernel
92s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 11:49

Target
e9ebeebe0e12c697eb8b830d9644ab0a_JaffaCakes118.exe
Size 274KB
Sample240409-nzg83seb66
SHA256 3f5edbd50b257e54f2d118d729920f99cab56c83dfb57c8977e19a50825bf527
MD5 e9ebeebe0e12c697eb8b830d9644ab0a
SHA1 b9aa4e76c64a1738ec31d139d0099e6fe479dda9
SHA512 c5d37c52934b570c3a2109e0ff2a0a6e3b1b5888ec81185bfb350836bf84f9f7d80ea44c110b6107001329001d3b36acb6acc582ba8a79db0eda5a55e8537ba1
SSDEEP 6144:50GfJHuSwqQQsmlU/jb7jwNIzi+xMgHblF:WGxHPy8ugN2i+mSblF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/4276-2-0x0000000000400000-0x000000000054B000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	4276	WerFault.exe	85

C:\Users\Admin\AppData\Local\Temp\e9ebeebe0e12c697eb8b830d9644ab0a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e9ebeebe0e12c697eb8b830d9644ab0a_JaffaCakes118.exe"
1⤵
PID:4276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 312
  2⤵
  - Program crash
  PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4276 -ip 4276
1⤵
PID:1348

memory/4276-0-0x0000000000400000-0x000000000054B000-memory.dmp

Download

memory/4276-1-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/4276-2-0x0000000000400000-0x000000000054B000-memory.dmp

Download