modiloader | 00599923cca36b3469b08d403621cd12e32bb306707289415a855aad22712998

Analysis

max time kernel
78s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 18:42

Target

0003572d22ee56ee0f0f88b0aded1358_JaffaCakes118.dll
Size

21KB
MD5

0003572d22ee56ee0f0f88b0aded1358
SHA1

87ef9aa434c8551741f1b72b96b2a221ec705998
SHA256

00599923cca36b3469b08d403621cd12e32bb306707289415a855aad22712998
SHA512

47ad5d8a25640bb0e477301c64d8d0686fa8030f43ee3686117a874b08bc570177cad0817157f2aad89541d98b9a97f7e3c679998c649c19cdaebeb1a2c10e00
SSDEEP

384:3spdjjEwsYfdeUmkT9vUGyKdv6IbU8DT9buEcZlcce3PywH0X:KjdsmdeudUlmV9kEcZlViPy4y

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1128-0-0x0000000000400000-0x0000000000424000-memory.dmp	modiloader_stage2

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 416 wrote to memory of 1128	416	regsvr32.exe	regsvr32.exe
PID 416 wrote to memory of 1128	416	regsvr32.exe	regsvr32.exe
PID 416 wrote to memory of 1128	416	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0003572d22ee56ee0f0f88b0aded1358_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:416

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\0003572d22ee56ee0f0f88b0aded1358_JaffaCakes118.dll
2⤵
PID:1128

memory/1128-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download