modiloader | 14959723b45dc463c57799e9ddd1b04fca932e71e0002c71edc5fd1dad272922

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe
Size

889KB
MD5

954edf8f28e3717418120976e58cf6db
SHA1

d41ad483ae595f521189c0dcdd27b9651ef1edc7
SHA256

14959723b45dc463c57799e9ddd1b04fca932e71e0002c71edc5fd1dad272922
SHA512

5171a7499f7f713d1954876849d63f676f102e38b487e4aaa10adc774bf7d3d65657631669cd79d64e4ed0c176e0ae96d9d31dabe6e8fe58b42737da8e9e82b6
SSDEEP

12288:DZREX+Lzw1fVVPvIWbYapcVp5csRbSA6E7xvWVL+doDfO7QCO:DnZw1tBjEp5c2bSO9vWVqQsQ

Score

10^/10

modiloader trojan

Malware Config

Extracted

Family

modiloader

https://drive.google.com/u/0/uc?id=1kcX7RsN6jGkPAYJe_ZoIco9Xdpwtpbw7&export=download

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1776-2-0x0000000000380000-0x00000000003BA000-memory.dmp	modiloader_stage1
behavioral1/memory/1776-3-0x0000000000380000-0x00000000003BA000-memory.dmp	modiloader_stage1

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

5 drive.google.com
6 drive.google.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2444 1776 WerFault.exe 954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe

flow	ioc
5	drive.google.com
6	drive.google.com

pid	pid_target	process	target process
2444	1776	WerFault.exe	954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe

description	pid	process	target process
PID 1776 wrote to memory of 2444	1776	954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe	WerFault.exe
PID 1776 wrote to memory of 2444	1776	954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe	WerFault.exe
PID 1776 wrote to memory of 2444	1776	954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe	WerFault.exe
PID 1776 wrote to memory of 2444	1776	954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 1504
2⤵
- Program crash
PID:2444

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1776-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1776-1-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/1776-2-0x0000000000380000-0x00000000003BA000-memory.dmp

Filesize
232KB

Download
memory/1776-3-0x0000000000380000-0x00000000003BA000-memory.dmp

Filesize
232KB

Download
memory/1776-9-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1776-10-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download