modiloader | a475322f26172f4dad7c67d1f01426b31a45afbc448b8b01d3f4d09fb53b2f4f

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 22:54

Target

010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe
Size

26KB
MD5

010017e186c37470c1208876f7bb2db3
SHA1

6ddcc3756f32e75d0e782b832860dc9595326874
SHA256

a475322f26172f4dad7c67d1f01426b31a45afbc448b8b01d3f4d09fb53b2f4f
SHA512

3e30f2aa73576f65470952c71676ee429c4142d0147478fa3a27201fd614834d1fb46eb60c3e5add1392502d33267c7bbed3602366c4d7f15209b29beb46ab42
SSDEEP

384:fdKoA0iaVZAszu/RQ+mLyvXYu5+z0jfSkkn0BzzqNhfF0axPn9qGciTtxs0F4XkA:f4oTHupC2/kgqkk05whcG/LsXkA

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2228-0-0x0000000000400000-0x0000000000425000-memory.dmp	modiloader_stage2
behavioral1/memory/3040-12-0x0000000000400000-0x0000000000425000-memory.dmp	modiloader_stage2
behavioral1/memory/2228-13-0x0000000000400000-0x0000000000425000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

winow.exe

pid process

3040 winow.exe

pid	process
3040	winow.exe

Drops file in Windows directory 5 IoCs

Processes:

010017e186c37470c1208876f7bb2db3_JaffaCakes118.exewinow.exe

description	ioc	process
File created	C:\Windows\winow.dll	010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe
File created	C:\Windows\winow.exe	010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe
File opened for modification	C:\Windows\winow.exe	010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe
File created	C:\Windows\winow.dll	winow.exe
File created	C:\Windows\winow.exe	winow.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe

description	pid	process	target process
PID 2228 wrote to memory of 3040	2228	010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe	winow.exe
PID 2228 wrote to memory of 3040	2228	010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe	winow.exe
PID 2228 wrote to memory of 3040	2228	010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe	winow.exe
PID 2228 wrote to memory of 3040	2228	010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe	winow.exe

C:\Windows\winow.dll
Filesize
33KB

MD5
5e0e81a2ef1a5013e7e3593b165590a0

SHA1
a940fc1e724b61a86acdc232669f0a50775cd840

SHA256
c3fe5505e2c18a9aedf654906184bd21a0ee889908894ca824ec7a6945edcca1

SHA512
4d47dd00a716f0492ddbe0974ba2f906e9602cffec8da61789a5232918abe44216df250bdd1ddcc0b75a3f583520119e4bbf687dfdb116c4336b80921577aa9b

Download Submit
C:\Windows\winow.exe
Filesize
26KB

MD5
010017e186c37470c1208876f7bb2db3

SHA1
6ddcc3756f32e75d0e782b832860dc9595326874

SHA256
a475322f26172f4dad7c67d1f01426b31a45afbc448b8b01d3f4d09fb53b2f4f

SHA512
3e30f2aa73576f65470952c71676ee429c4142d0147478fa3a27201fd614834d1fb46eb60c3e5add1392502d33267c7bbed3602366c4d7f15209b29beb46ab42

Download Submit
memory/2228-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2228-8-0x0000000000220000-0x0000000000245000-memory.dmp

Filesize
148KB

Download
memory/2228-7-0x0000000000220000-0x0000000000245000-memory.dmp

Filesize
148KB

Download
memory/2228-13-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3040-12-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download