modiloader | ebae1f536dfb75199129f054ffc84171f216d14a263912fc5412d1a6ab5d2390

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 19:19

Target

fffbc389c9eb84dd2bf21f21d60b0887_JaffaCakes118.exe
Size

310KB
MD5

fffbc389c9eb84dd2bf21f21d60b0887
SHA1

253d070577be040848686cf2cd3acca18cadb968
SHA256

ebae1f536dfb75199129f054ffc84171f216d14a263912fc5412d1a6ab5d2390
SHA512

293cc3ab85e162996b3a2017d92fcc14652b819b862260ab4db5fec264c8aa2862dae035078c94b4811a5d5fa7fdd7b6ee6ce1e0562f7c95b259dd51e25abe36
SSDEEP

6144:37ROY0kFrKTleoP1hex4NYDzrljwD5OSlpdsi10aEPH:3Y8eTlTi4GbiUS/sW

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2868-2-0x0000000000400000-0x0000000000458000-memory.dmp	modiloader_stage2

Suspicious use of UnmapMainImage 1 IoCs

Processes:

fffbc389c9eb84dd2bf21f21d60b0887_JaffaCakes118.exe

pid process

2868 fffbc389c9eb84dd2bf21f21d60b0887_JaffaCakes118.exe

pid	process
2868	fffbc389c9eb84dd2bf21f21d60b0887_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fffbc389c9eb84dd2bf21f21d60b0887_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fffbc389c9eb84dd2bf21f21d60b0887_JaffaCakes118.exe"
1⤵
- Suspicious use of UnmapMainImage
PID:2868

memory/2868-0-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2868-1-0x0000000000460000-0x00000000004B8000-memory.dmp

Filesize
352KB

Download
memory/2868-2-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download