modiloader | f61291715f368c2089c99aff3811382b17314750e6f3088fa1c96bdfb37ed383

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 06:11

Target

a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exe
Size

104KB
MD5

a845de7e8d88bb394683f055d5c539f1
SHA1

341ea7996fe18db12ab960b54e58e5d13483fc19
SHA256

f61291715f368c2089c99aff3811382b17314750e6f3088fa1c96bdfb37ed383
SHA512

8ba77d7225c562fe5d720aeb959facf7cf4b445c8a788bd84c9351a61cab417b51b1a01d8eb2ec865704a1c3a3d45b8eaa962f7af3372f40d111bfe7a7595f80
SSDEEP

3072:PLCnfuTOxhDd5CufhHXZPXnPryHd9UykJ65MMCY:PcxdCufBXx/md9Uy7MM

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
C:\Windows\apocalyps32.exe	modiloader_stage2
behavioral1/memory/2212-8-0x0000000000010000-0x0000000000030000-memory.dmp	modiloader_stage2
behavioral1/memory/1680-5-0x0000000000010000-0x0000000000030000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

apocalyps32.exe

pid process

2212 apocalyps32.exe

pid	process
2212	apocalyps32.exe

Drops file in Windows directory 3 IoCs

Processes:

a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exeapocalyps32.exe

description	ioc	process
File created	C:\Windows\apocalyps32.exe	a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exe
File opened for modification	C:\Windows\apocalyps32.exe	a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exe
File created	C:\Windows\apocalyps32.exe	apocalyps32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exeapocalyps32.exe

description	pid	process	target process
PID 1680 wrote to memory of 2212	1680	a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exe	apocalyps32.exe
PID 1680 wrote to memory of 2212	1680	a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exe	apocalyps32.exe
PID 1680 wrote to memory of 2212	1680	a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exe	apocalyps32.exe
PID 1680 wrote to memory of 2212	1680	a845de7e8d88bb394683f055d5c539f1_JaffaCakes118.exe	apocalyps32.exe
PID 2212 wrote to memory of 1872	2212	apocalyps32.exe	iexplore.exe
PID 2212 wrote to memory of 1872	2212	apocalyps32.exe	iexplore.exe
PID 2212 wrote to memory of 1872	2212	apocalyps32.exe	iexplore.exe
PID 2212 wrote to memory of 1872	2212	apocalyps32.exe	iexplore.exe

C:\Windows\apocalyps32.exe
Filesize
104KB

MD5
a845de7e8d88bb394683f055d5c539f1

SHA1
341ea7996fe18db12ab960b54e58e5d13483fc19

SHA256
f61291715f368c2089c99aff3811382b17314750e6f3088fa1c96bdfb37ed383

SHA512
8ba77d7225c562fe5d720aeb959facf7cf4b445c8a788bd84c9351a61cab417b51b1a01d8eb2ec865704a1c3a3d45b8eaa962f7af3372f40d111bfe7a7595f80

Download Submit
memory/1680-5-0x0000000000010000-0x0000000000030000-memory.dmp

Filesize
128KB

Download
memory/2212-8-0x0000000000010000-0x0000000000030000-memory.dmp

Filesize
128KB

Download