modiloader | f7f76560c10e890681c96ed629c0ef35c93b2ba982eeeebe366e3414c86316ef

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 22:54

Target

01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
Size

37KB
MD5

01009c944ecb64a5254745a11a1a29a7
SHA1

d157047b7b4ad7b10b53e384c385aa3d340ccef2
SHA256

f7f76560c10e890681c96ed629c0ef35c93b2ba982eeeebe366e3414c86316ef
SHA512

6aa0bb28aa06c06433e135faf37b24fc63606d915590a8a08c2ea64132ed6805da264f64258390e95374bf690bfb8346c77cd8e3daecaf82fa7b3090e6ad26a0
SSDEEP

768:lA8JqBjJh8wd2Q8Esskb5mdKO+fLkf/xd0S+Eadpi:lsVGs4HfwnxL3adw

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1800-7-0x0000000020000000-0x0000000020010000-memory.dmp	modiloader_stage2

Drops file in System32 directory 2 IoCs

Processes:

01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\win.com	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\win.com	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

description	pid	process	target process
PID 1800 set thread context of 3296	1800	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

pid process

3296 01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
3296 01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 3296 01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

pid	process
3296	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
3296	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	3296	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe

description	pid	process	target process
PID 1800 wrote to memory of 3296	1800	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
PID 1800 wrote to memory of 3296	1800	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
PID 1800 wrote to memory of 3296	1800	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
PID 1800 wrote to memory of 3296	1800	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
PID 1800 wrote to memory of 3296	1800	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe
PID 3296 wrote to memory of 3240	3296	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe	Explorer.EXE
PID 3296 wrote to memory of 3240	3296	01009c944ecb64a5254745a11a1a29a7_JaffaCakes118.exe	Explorer.EXE

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2652

memory/1800-1-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/1800-0-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/1800-2-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/1800-7-0x0000000020000000-0x0000000020010000-memory.dmp

Filesize
64KB

Download
memory/3296-3-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3296-5-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3296-6-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3296-10-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download