modiloader | f7f76560c10e890681c96ed629c0ef35c93b2ba982eeeebe366e3414c86316ef

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
Size

37KB
MD5

01009c944ecb64a5254745a11a1a29a7
SHA1

d157047b7b4ad7b10b53e384c385aa3d340ccef2
SHA256

f7f76560c10e890681c96ed629c0ef35c93b2ba982eeeebe366e3414c86316ef
SHA512

6aa0bb28aa06c06433e135faf37b24fc63606d915590a8a08c2ea64132ed6805da264f64258390e95374bf690bfb8346c77cd8e3daecaf82fa7b3090e6ad26a0
SSDEEP

768:lA8JqBjJh8wd2Q8Esskb5mdKO+fLkf/xd0S+Eadpi:lsVGs4HfwnxL3adw

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2376-22-0x0000000020000000-0x0000000020010000-memory.dmp	modiloader_stage2

Drops file in System32 directory 2 IoCs

Processes:

01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\win.com	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\win.com	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

description	pid	process	target process
PID 2376 set thread context of 1912	2376	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

pid process

1912 01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1912 01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

pid	process
1912	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1912	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

description	pid	process	target process
PID 2376 wrote to memory of 1912	2376	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
PID 2376 wrote to memory of 1912	2376	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
PID 2376 wrote to memory of 1912	2376	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
PID 2376 wrote to memory of 1912	2376	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
PID 2376 wrote to memory of 1912	2376	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
PID 2376 wrote to memory of 1912	2376	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
PID 1912 wrote to memory of 1180	1912	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe	Explorer.EXE
PID 1912 wrote to memory of 1180	1912	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1180

C:\Users\Admin\AppData\Local\Temp\01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2376

C:\Users\Admin\AppData\Local\Temp\01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1912-15-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1912-13-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1912-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1912-10-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1912-20-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2376-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2376-8-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2376-9-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2376-21-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2376-22-0x0000000020000000-0x0000000020010000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads