modiloader | 2fe6397cdcf6b9697ba2df281ef68e50f79f1000bbc58d9bbe60e71be4fc3d50

Analysis

max time kernel
137s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2024, 19:13

Target
1df83652c2ff87d8354c67761cc75af8_JaffaCakes118.exe
Size 858KB
Sample240506-xw995aaa75
SHA256 2fe6397cdcf6b9697ba2df281ef68e50f79f1000bbc58d9bbe60e71be4fc3d50
MD5 1df83652c2ff87d8354c67761cc75af8
SHA1 a506c9628185801d1f9880e867682cdde285d2c7
SHA512 92b3c9eb1367b08747c01508671d87225bb18eedf2dc9542c6c6bc6a876baef905dbd48ab3f8164d3c480946096198888e419e3bd1191ecec89b5383f63e9367
SSDEEP 24576:XoK9U9Z5Y4+YSembcj3jtpTm7bUDWzPuNML851cM9wAY:XoQU9Z5Y4+YSembcj3jjTcDuNML851cZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/752-0-0x0000000000010000-0x00000000000EC000-memory.dmp	modiloader_stage2

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1912	752	1df83652c2ff87d8354c67761cc75af8_JaffaCakes118.exe	97
PID 752 wrote to memory of 1912	752	1df83652c2ff87d8354c67761cc75af8_JaffaCakes118.exe	97
PID 752 wrote to memory of 1912	752	1df83652c2ff87d8354c67761cc75af8_JaffaCakes118.exe	97

C:\Users\Admin\AppData\Local\Temp\1df83652c2ff87d8354c67761cc75af8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1df83652c2ff87d8354c67761cc75af8_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Users\Admin\AppData\Local\Temp\1df83652c2ff87d8354c67761cc75af8_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\1df83652c2ff87d8354c67761cc75af8_JaffaCakes118.exe
  2⤵
  PID:1912

memory/752-0-0x0000000000010000-0x00000000000EC000-memory.dmp

Download