modiloader | a475322f26172f4dad7c67d1f01426b31a45afbc448b8b01d3f4d09fb53b2f4f

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 22:54

Target

010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe
Size

26KB
MD5

010017e186c37470c1208876f7bb2db3
SHA1

6ddcc3756f32e75d0e782b832860dc9595326874
SHA256

a475322f26172f4dad7c67d1f01426b31a45afbc448b8b01d3f4d09fb53b2f4f
SHA512

3e30f2aa73576f65470952c71676ee429c4142d0147478fa3a27201fd614834d1fb46eb60c3e5add1392502d33267c7bbed3602366c4d7f15209b29beb46ab42
SSDEEP

384:fdKoA0iaVZAszu/RQ+mLyvXYu5+z0jfSkkn0BzzqNhfF0axPn9qGciTtxs0F4XkA:f4oTHupC2/kgqkk05whcG/LsXkA

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1616-14-0x0000000000400000-0x0000000000425000-memory.dmp	modiloader_stage2
behavioral2/memory/2388-17-0x0000000000400000-0x0000000000425000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

winow.exe

pid process

2388 winow.exe
Loads dropped DLL 2 IoCs

Processes:

winow.exe

pid process

2388 winow.exe
2388 winow.exe

pid	process
2388	winow.exe

pid	process
2388	winow.exe
2388	winow.exe

Drops file in Windows directory 5 IoCs

Processes:

010017e186c37470c1208876f7bb2db3_JaffaCakes118.exewinow.exe

description	ioc	process
File opened for modification	C:\Windows\winow.exe	010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe
File created	C:\Windows\winow.dll	winow.exe
File created	C:\Windows\winow.exe	winow.exe
File created	C:\Windows\winow.dll	010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe
File created	C:\Windows\winow.exe	010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

winow.exe

pid process

2388 winow.exe

pid	process
2388	winow.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe

description	pid	process	target process
PID 1616 wrote to memory of 2388	1616	010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe	winow.exe
PID 1616 wrote to memory of 2388	1616	010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe	winow.exe
PID 1616 wrote to memory of 2388	1616	010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe	winow.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4020 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:848

C:\Windows\winow.dll
Filesize
33KB

MD5
5e0e81a2ef1a5013e7e3593b165590a0

SHA1
a940fc1e724b61a86acdc232669f0a50775cd840

SHA256
c3fe5505e2c18a9aedf654906184bd21a0ee889908894ca824ec7a6945edcca1

SHA512
4d47dd00a716f0492ddbe0974ba2f906e9602cffec8da61789a5232918abe44216df250bdd1ddcc0b75a3f583520119e4bbf687dfdb116c4336b80921577aa9b

Download Submit
C:\Windows\winow.exe
Filesize
26KB

MD5
010017e186c37470c1208876f7bb2db3

SHA1
6ddcc3756f32e75d0e782b832860dc9595326874

SHA256
a475322f26172f4dad7c67d1f01426b31a45afbc448b8b01d3f4d09fb53b2f4f

SHA512
3e30f2aa73576f65470952c71676ee429c4142d0147478fa3a27201fd614834d1fb46eb60c3e5add1392502d33267c7bbed3602366c4d7f15209b29beb46ab42

Download Submit
memory/1616-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1616-14-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2388-11-0x0000000000440000-0x000000000044E000-memory.dmp

Filesize
56KB

Download
memory/2388-15-0x0000000000440000-0x000000000044E000-memory.dmp

Filesize
56KB

Download
memory/2388-17-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download