modiloader | 6daa12904cbeb40cb1a8ee8771090ca4553bbddf4d782c190f7a0dd7846f1326

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 22:01

Target

00c1761fec6dc511dd12ed2b6fa1c974_JaffaCakes118.exe
Size

311KB
MD5

00c1761fec6dc511dd12ed2b6fa1c974
SHA1

c52671c4be6bd3799b0b9ec6dd51b6e23ea120ac
SHA256

6daa12904cbeb40cb1a8ee8771090ca4553bbddf4d782c190f7a0dd7846f1326
SHA512

2621f1685354edbb4f4f7f9f8285a3d89c790191b7487329e7433f02face955879eccca08bb66a203d981d0101ccff929dc51d462ed893311cfad5cc8f228cec
SSDEEP

6144:sftuCFu6HvfdTqamKhH1PpQIAcltnQp/NgbdjFnDnAo5Wv9bKHs1DkwARL+JywOO:wtF3lO20hcnQpCFnDnAl1cslYRL+JRbl

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1712-1-0x0000000000400000-0x00000000004BF000-memory.dmp	modiloader_stage2
behavioral1/memory/1712-4-0x0000000000400000-0x00000000004BF000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

Processes:

00c1761fec6dc511dd12ed2b6fa1c974_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt	00c1761fec6dc511dd12ed2b6fa1c974_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

00c1761fec6dc511dd12ed2b6fa1c974_JaffaCakes118.exe

description	pid	process	target process
PID 1712 wrote to memory of 2444	1712	00c1761fec6dc511dd12ed2b6fa1c974_JaffaCakes118.exe	IEXPLORE.EXE
PID 1712 wrote to memory of 2444	1712	00c1761fec6dc511dd12ed2b6fa1c974_JaffaCakes118.exe	IEXPLORE.EXE
PID 1712 wrote to memory of 2444	1712	00c1761fec6dc511dd12ed2b6fa1c974_JaffaCakes118.exe	IEXPLORE.EXE
PID 1712 wrote to memory of 2444	1712	00c1761fec6dc511dd12ed2b6fa1c974_JaffaCakes118.exe	IEXPLORE.EXE

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
2⤵
PID:2444

memory/1712-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1712-1-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1712-2-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1712-4-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download