modiloader | 7af8035bb2e914eb4a4972ebdcce4905cc3a62a526c4dc4836ab5a56f5118e20

Analysis

max time kernel
138s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 11:00

Target

ff20f7934a6971a0273f41ad818fa712_JaffaCakes118.exe
Size

414KB
MD5

ff20f7934a6971a0273f41ad818fa712
SHA1

7af448723fd13e7f2b90d6a744f465cbefd2387c
SHA256

7af8035bb2e914eb4a4972ebdcce4905cc3a62a526c4dc4836ab5a56f5118e20
SHA512

0acf4c195cabd9d4f438e4c1c31d2979c40a683cfb3dc8d6666e5c249e77ced80a5ea8a67b4aab5dedeb234023bd5a3200e4b2450aaff6fbb84192b87a8695c0
SSDEEP

6144:ajDDsKYcVIgWrFeHbRT4FbDfBi87rzIPP4ML++E4uABCw/XjlaCi0Zqu7fbI7xnP:8DYHZbeHhA3Bj78gMJuiv/XxzoSwB1

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3120-3-0x0000000000400000-0x00000000004D48BB-memory.dmp	modiloader_stage2

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

ff20f7934a6971a0273f41ad818fa712_JaffaCakes118.exe

pid process

3120 ff20f7934a6971a0273f41ad818fa712_JaffaCakes118.exe
3120 ff20f7934a6971a0273f41ad818fa712_JaffaCakes118.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2540 3120 WerFault.exe ff20f7934a6971a0273f41ad818fa712_JaffaCakes118.exe

pid	process
3120	ff20f7934a6971a0273f41ad818fa712_JaffaCakes118.exe
3120	ff20f7934a6971a0273f41ad818fa712_JaffaCakes118.exe

pid	pid_target	process	target process
2540	3120	WerFault.exe	ff20f7934a6971a0273f41ad818fa712_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ff20f7934a6971a0273f41ad818fa712_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ff20f7934a6971a0273f41ad818fa712_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 272
2⤵
- Program crash
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3120 -ip 3120
1⤵
PID:1912

memory/3120-0-0x0000000000400000-0x00000000004D48BB-memory.dmp

Filesize
850KB

Download
memory/3120-1-0x00000000004BE000-0x00000000004D5000-memory.dmp

Filesize
92KB

Download
memory/3120-2-0x00000000004BE000-0x00000000004D5000-memory.dmp

Filesize
92KB

Download
memory/3120-3-0x0000000000400000-0x00000000004D48BB-memory.dmp

Filesize
850KB

Download