modiloader | 1fe8df87466ff32ed691bfb5730cb86259b4fd959e8397f0ea3f830291ad3355

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 23:35

Target

01327eafd5460a3d9961634f34d40368_JaffaCakes118.exe
Size

239KB
MD5

01327eafd5460a3d9961634f34d40368
SHA1

96d08cb3c890e7a89f9206c1a77021e19c23358e
SHA256

1fe8df87466ff32ed691bfb5730cb86259b4fd959e8397f0ea3f830291ad3355
SHA512

e7556a80521f8cff2e8cb65603a0d847811e6e4601478aa0d1cf94984c5f0134e1904c7c46ccff7a0f2171feaf19d553d8fd9dce7482bef143955a4396976af3
SSDEEP

6144:4s4caMo7UsCaVNro7xU6UmxsYjXBYRAS2gBuHs:O5TU0NreBUmHYRASd

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2028-12-0x0000000000400000-0x000000000048D200-memory.dmp	modiloader_stage2
behavioral1/memory/2028-17-0x0000000000400000-0x000000000048D200-memory.dmp	modiloader_stage2
behavioral1/memory/1780-25-0x0000000000400000-0x000000000048D200-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2416 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

svcoys.exe

pid process

2028 svcoys.exe
Loads dropped DLL 2 IoCs

Processes:

01327eafd5460a3d9961634f34d40368_JaffaCakes118.exe

pid process

1780 01327eafd5460a3d9961634f34d40368_JaffaCakes118.exe
1780 01327eafd5460a3d9961634f34d40368_JaffaCakes118.exe

pid	process
2416	cmd.exe

pid	process
2028	svcoys.exe

pid	process
1780	01327eafd5460a3d9961634f34d40368_JaffaCakes118.exe
1780	01327eafd5460a3d9961634f34d40368_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

Processes:

01327eafd5460a3d9961634f34d40368_JaffaCakes118.exesvcoys.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\svcoys.exe	01327eafd5460a3d9961634f34d40368_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\svcoys.exe	svcoys.exe
File created	C:\Windows\SysWOW64\Deleteme.bat	01327eafd5460a3d9961634f34d40368_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\svcoys.exe	01327eafd5460a3d9961634f34d40368_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

01327eafd5460a3d9961634f34d40368_JaffaCakes118.exe

description	pid	process	target process
PID 1780 wrote to memory of 2028	1780	01327eafd5460a3d9961634f34d40368_JaffaCakes118.exe	svcoys.exe
PID 1780 wrote to memory of 2028	1780	01327eafd5460a3d9961634f34d40368_JaffaCakes118.exe	svcoys.exe
PID 1780 wrote to memory of 2028	1780	01327eafd5460a3d9961634f34d40368_JaffaCakes118.exe	svcoys.exe
PID 1780 wrote to memory of 2028	1780	01327eafd5460a3d9961634f34d40368_JaffaCakes118.exe	svcoys.exe
PID 1780 wrote to memory of 2416	1780	01327eafd5460a3d9961634f34d40368_JaffaCakes118.exe	cmd.exe
PID 1780 wrote to memory of 2416	1780	01327eafd5460a3d9961634f34d40368_JaffaCakes118.exe	cmd.exe
PID 1780 wrote to memory of 2416	1780	01327eafd5460a3d9961634f34d40368_JaffaCakes118.exe	cmd.exe
PID 1780 wrote to memory of 2416	1780	01327eafd5460a3d9961634f34d40368_JaffaCakes118.exe	cmd.exe

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Windows\system32\Deleteme.bat
2⤵
- Deletes itself
PID:2416

C:\Windows\SysWOW64\Deleteme.bat
Filesize
212B

MD5
97ddb65f799ca26cbf066236c09d96dc

SHA1
42c122f02d76b09280ae25dc2d37e766fa936b18

SHA256
863cfc9719779a8475fce7b193dc32ab1a31e17c75b93c5ef0d7cf5c84e93fa6

SHA512
f216e74cd479ea4c32c9f678809a296d54f84dbcbd85a583b193444a5e69e38d02d0b79ba0acaa50f638ea53dac3e3bda70f5f180bd3ffe9a8b059d5e44f34d2

Download Submit
\Windows\SysWOW64\svcoys.exe
Filesize
239KB

MD5
01327eafd5460a3d9961634f34d40368

SHA1
96d08cb3c890e7a89f9206c1a77021e19c23358e

SHA256
1fe8df87466ff32ed691bfb5730cb86259b4fd959e8397f0ea3f830291ad3355

SHA512
e7556a80521f8cff2e8cb65603a0d847811e6e4601478aa0d1cf94984c5f0134e1904c7c46ccff7a0f2171feaf19d553d8fd9dce7482bef143955a4396976af3

Download Submit
memory/1780-0-0x0000000000400000-0x000000000048D200-memory.dmp

Filesize
564KB

Download
memory/1780-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1780-5-0x0000000000350000-0x00000000003DE000-memory.dmp

Filesize
568KB

Download
memory/1780-25-0x0000000000400000-0x000000000048D200-memory.dmp

Filesize
564KB

Download
memory/2028-14-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2028-12-0x0000000000400000-0x000000000048D200-memory.dmp

Filesize
564KB

Download
memory/2028-17-0x0000000000400000-0x000000000048D200-memory.dmp

Filesize
564KB

Download