modiloader | 14959723b45dc463c57799e9ddd1b04fca932e71e0002c71edc5fd1dad272922

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe
Size

889KB
MD5

954edf8f28e3717418120976e58cf6db
SHA1

d41ad483ae595f521189c0dcdd27b9651ef1edc7
SHA256

14959723b45dc463c57799e9ddd1b04fca932e71e0002c71edc5fd1dad272922
SHA512

5171a7499f7f713d1954876849d63f676f102e38b487e4aaa10adc774bf7d3d65657631669cd79d64e4ed0c176e0ae96d9d31dabe6e8fe58b42737da8e9e82b6
SSDEEP

12288:DZREX+Lzw1fVVPvIWbYapcVp5csRbSA6E7xvWVL+doDfO7QCO:DnZw1tBjEp5c2bSO9vWVqQsQ

Score

10^/10

modiloader trojan

Malware Config

Extracted

Family

modiloader

https://drive.google.com/u/0/uc?id=1kcX7RsN6jGkPAYJe_ZoIco9Xdpwtpbw7&export=download

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 2 IoCs

resource	yara_rule
behavioral1/memory/1776-2-0x0000000000380000-0x00000000003BA000-memory.dmp	modiloader_stage1
behavioral1/memory/1776-3-0x0000000000380000-0x00000000003BA000-memory.dmp	modiloader_stage1

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
6	drive.google.com

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2444	1776	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 2444	1776	954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe	29
PID 1776 wrote to memory of 2444	1776	954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe	29
PID 1776 wrote to memory of 2444	1776	954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe	29
PID 1776 wrote to memory of 2444	1776	954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 1504
  2⤵
  - Program crash
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1776-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1776-1-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/1776-2-0x0000000000380000-0x00000000003BA000-memory.dmp

Filesize
232KB

Download
memory/1776-3-0x0000000000380000-0x00000000003BA000-memory.dmp

Filesize
232KB

Download
memory/1776-9-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1776-10-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download