modiloader | 24e742bfb1c40f466eeec9d6f7dcb5a44ddeba462ea9b549144001343648b729

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 18:49

Target

00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe
Size

172KB
MD5

00088f0045ec4c38cfce5fb7439e7cd0
SHA1

7fb73fd566b03f408740cd7230e1dfcdeff162cd
SHA256

24e742bfb1c40f466eeec9d6f7dcb5a44ddeba462ea9b549144001343648b729
SHA512

dfdc582b0dd2a1669648af69dbbb093c42df37582d65368501e120ebaad91d2eeea3fce28547c85859a196cf16d75e9fe425edcd4e934cec49c105a11f77eff5
SSDEEP

3072:2ftS4+XWK71qcP1JUHVs0aUnRM0y++8aYM3YdQDeu9TjPJCDF4s8dXPN2sYsEUf:2f4WK71FtJ660aUnSVovuTjPJCDEVVr

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2360-22-0x0000000020000000-0x0000000020037000-memory.dmp	modiloader_stage2
behavioral1/memory/2360-20-0x0000000020000000-0x0000000020037000-memory.dmp	modiloader_stage2
behavioral1/memory/2360-11-0x0000000020001000-0x0000000020004000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

Processes:

00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe

description	pid	process	target process
PID 2360 set thread context of 3020	2360	00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe	00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe

pid process

2360 00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe

pid	process
2360	00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe

description	pid	process	target process
PID 2360 wrote to memory of 3020	2360	00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe	00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe
PID 2360 wrote to memory of 3020	2360	00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe	00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe
PID 2360 wrote to memory of 3020	2360	00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe	00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe
PID 2360 wrote to memory of 3020	2360	00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe	00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe
PID 2360 wrote to memory of 3020	2360	00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe	00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe
PID 2360 wrote to memory of 3020	2360	00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe	00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\00088f0045ec4c38cfce5fb7439e7cd0_JaffaCakes118.exe
2⤵
PID:3020

memory/2360-11-0x0000000020001000-0x0000000020004000-memory.dmp

Filesize
12KB

Download
memory/2360-1-0x0000000000240000-0x000000000026D000-memory.dmp

Filesize
180KB

Download
memory/2360-2-0x0000000000240000-0x000000000026D000-memory.dmp

Filesize
180KB

Download
memory/2360-0-0x0000000020000000-0x0000000020037000-memory.dmp

Filesize
220KB

Download
memory/2360-22-0x0000000020000000-0x0000000020037000-memory.dmp

Filesize
220KB

Download
memory/2360-21-0x0000000000240000-0x000000000026D000-memory.dmp

Filesize
180KB

Download
memory/2360-20-0x0000000020000000-0x0000000020037000-memory.dmp

Filesize
220KB

Download
memory/2360-3-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2360-17-0x0000000020000000-0x0000000020037000-memory.dmp

Filesize
220KB

Download
memory/3020-23-0x0000000020000000-0x0000000020037000-memory.dmp

Filesize
220KB

Download
memory/3020-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3020-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3020-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3020-19-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download