modiloader | 52d78a633fe824a93eb065a58ac14fcbf5398c5e9e944a66df24fd0ea543263d

Analysis

max time kernel
142s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 08:06

Target

910e58b9696ce177c75b1d35ff20dbdc_JaffaCakes118.exe
Size

95KB
MD5

910e58b9696ce177c75b1d35ff20dbdc
SHA1

60d85f0e651c33718b518502b121090836cd8a90
SHA256

52d78a633fe824a93eb065a58ac14fcbf5398c5e9e944a66df24fd0ea543263d
SHA512

18ac3954f0c66f139a547b0547e58e0c4dfe3c86caed44d4979095444e030d74e23fd259b05301ae2e004805bd328edcbbca7356baa5dc30c9a9d333c4c3e84d
SSDEEP

1536:CC2qEQug2dM0EidaZjImaIM9iO8d12qQ46H39NXoyL/alYsTEu6non71/U89:C7bxd/eIfv9P8d12qQXN9oyL/alJTEp6

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2880-9-0x0000000000400000-0x000000000041E000-memory.dmp	modiloader_stage2
C:\Users\Admin\Documents\Windows\svchost.exe	modiloader_stage2
behavioral1/memory/2632-11-0x0000000000400000-0x000000000041E000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-15-0x0000000000400000-0x000000000041E000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-19-0x0000000000400000-0x000000000041E000-memory.dmp	modiloader_stage2
behavioral1/memory/2632-23-0x0000000000400000-0x000000000041E000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2632 svchost.exe
Loads dropped DLL 2 IoCs

Processes:

910e58b9696ce177c75b1d35ff20dbdc_JaffaCakes118.exe

pid process

2880 910e58b9696ce177c75b1d35ff20dbdc_JaffaCakes118.exe
2880 910e58b9696ce177c75b1d35ff20dbdc_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2632	svchost.exe

pid	process
2880	910e58b9696ce177c75b1d35ff20dbdc_JaffaCakes118.exe
2880	910e58b9696ce177c75b1d35ff20dbdc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

910e58b9696ce177c75b1d35ff20dbdc_JaffaCakes118.exe

description	pid	process	target process
PID 2880 wrote to memory of 2632	2880	910e58b9696ce177c75b1d35ff20dbdc_JaffaCakes118.exe	svchost.exe
PID 2880 wrote to memory of 2632	2880	910e58b9696ce177c75b1d35ff20dbdc_JaffaCakes118.exe	svchost.exe
PID 2880 wrote to memory of 2632	2880	910e58b9696ce177c75b1d35ff20dbdc_JaffaCakes118.exe	svchost.exe
PID 2880 wrote to memory of 2632	2880	910e58b9696ce177c75b1d35ff20dbdc_JaffaCakes118.exe	svchost.exe

C:\Users\Admin\Documents\Windows\svchost.exe
"C:\Users\Admin\Documents\Windows\svchost.exe"
2⤵
- Executes dropped EXE
PID:2632

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\Documents\Windows\svchost.exe
Filesize
95KB

MD5
910e58b9696ce177c75b1d35ff20dbdc

SHA1
60d85f0e651c33718b518502b121090836cd8a90

SHA256
52d78a633fe824a93eb065a58ac14fcbf5398c5e9e944a66df24fd0ea543263d

SHA512
18ac3954f0c66f139a547b0547e58e0c4dfe3c86caed44d4979095444e030d74e23fd259b05301ae2e004805bd328edcbbca7356baa5dc30c9a9d333c4c3e84d

Download Submit
memory/2632-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2632-15-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2632-19-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2632-23-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2880-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download