modiloader | ebae1f536dfb75199129f054ffc84171f216d14a263912fc5412d1a6ab5d2390

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 19:19

Target

fffbc389c9eb84dd2bf21f21d60b0887_JaffaCakes118.exe
Size

310KB
MD5

fffbc389c9eb84dd2bf21f21d60b0887
SHA1

253d070577be040848686cf2cd3acca18cadb968
SHA256

ebae1f536dfb75199129f054ffc84171f216d14a263912fc5412d1a6ab5d2390
SHA512

293cc3ab85e162996b3a2017d92fcc14652b819b862260ab4db5fec264c8aa2862dae035078c94b4811a5d5fa7fdd7b6ee6ce1e0562f7c95b259dd51e25abe36
SSDEEP

6144:37ROY0kFrKTleoP1hex4NYDzrljwD5OSlpdsi10aEPH:3Y8eTlTi4GbiUS/sW

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/388-2-0x0000000000400000-0x000000000044D000-memory.dmp	modiloader_stage2

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2924 388 WerFault.exe fffbc389c9eb84dd2bf21f21d60b0887_JaffaCakes118.exe

pid	pid_target	process	target process
2924	388	WerFault.exe	fffbc389c9eb84dd2bf21f21d60b0887_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fffbc389c9eb84dd2bf21f21d60b0887_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fffbc389c9eb84dd2bf21f21d60b0887_JaffaCakes118.exe"
1⤵
PID:388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 332
2⤵
- Program crash
PID:2924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 388 -ip 388
1⤵
PID:2588

memory/388-0-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/388-1-0x0000000000660000-0x00000000006B8000-memory.dmp

Filesize
352KB

Download
memory/388-2-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download