modiloader | 14959723b45dc463c57799e9ddd1b04fca932e71e0002c71edc5fd1dad272922

Analysis

max time kernel
132s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 15:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe
Size

889KB
MD5

954edf8f28e3717418120976e58cf6db
SHA1

d41ad483ae595f521189c0dcdd27b9651ef1edc7
SHA256

14959723b45dc463c57799e9ddd1b04fca932e71e0002c71edc5fd1dad272922
SHA512

5171a7499f7f713d1954876849d63f676f102e38b487e4aaa10adc774bf7d3d65657631669cd79d64e4ed0c176e0ae96d9d31dabe6e8fe58b42737da8e9e82b6
SSDEEP

12288:DZREX+Lzw1fVVPvIWbYapcVp5csRbSA6E7xvWVL+doDfO7QCO:DnZw1tBjEp5c2bSO9vWVqQsQ

Score

10^/10

modiloader trojan

Malware Config

Extracted

Family

modiloader

https://drive.google.com/u/0/uc?id=1kcX7RsN6jGkPAYJe_ZoIco9Xdpwtpbw7&export=download

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader First Stage 1 IoCs

resource	yara_rule
behavioral2/memory/876-3-0x00000000023B0000-0x00000000023EA000-memory.dmp	modiloader_stage1

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
33	drive.google.com
34	drive.google.com

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4912	876	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\954edf8f28e3717418120976e58cf6db_JaffaCakes118.exe"
1⤵
PID:876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 1908
  2⤵
  - Program crash
  PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 876 -ip 876
1⤵
PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/876-0-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/876-1-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download
memory/876-3-0x00000000023B0000-0x00000000023EA000-memory.dmp

Filesize
232KB

Download
memory/876-9-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download