modiloader | 14959723b45dc463c57799e9ddd1b04fca932e71e0002c71edc5fd1dad272922

Analysis

max time kernel
132s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe
Size

889KB
MD5

954edf8f28e3717418120976e58cf6db
SHA1

d41ad483ae595f521189c0dcdd27b9651ef1edc7
SHA256

14959723b45dc463c57799e9ddd1b04fca932e71e0002c71edc5fd1dad272922
SHA512

5171a7499f7f713d1954876849d63f676f102e38b487e4aaa10adc774bf7d3d65657631669cd79d64e4ed0c176e0ae96d9d31dabe6e8fe58b42737da8e9e82b6
SSDEEP

12288:DZREX+Lzw1fVVPvIWbYapcVp5csRbSA6E7xvWVL+doDfO7QCO:DnZw1tBjEp5c2bSO9vWVqQsQ

Score

10^/10

modiloader trojan

Malware Config

Extracted

Family

modiloader

https://drive.google.com/u/0/uc?id=1kcX7RsN6jGkPAYJe_ZoIco9Xdpwtpbw7&export=download

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/876-3-0x00000000023B0000-0x00000000023EA000-memory.dmp	modiloader_stage1

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

33 drive.google.com
34 drive.google.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4912 876 WerFault.exe 954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe

flow	ioc
33	drive.google.com
34	drive.google.com

pid	pid_target	process	target process
4912	876	WerFault.exe	954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe"
1⤵
PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 1908
2⤵
- Program crash
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 876 -ip 876
1⤵
PID:756

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/876-0-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/876-1-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/876-3-0x00000000023B0000-0x00000000023EA000-memory.dmp

Filesize
232KB

Download
memory/876-9-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download