modiloader | d0410fd3d546c16e89ad8216993a0a5a8a58da2f7cf909125f5109f649b81619

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 21:23

Target

008ffcd20d2f024ec73058b2e7c11845_JaffaCakes118.exe
Size

694KB
MD5

008ffcd20d2f024ec73058b2e7c11845
SHA1

58edd707567361a9f4976333ab79217be2e7fddf
SHA256

d0410fd3d546c16e89ad8216993a0a5a8a58da2f7cf909125f5109f649b81619
SHA512

c47d2a23cb2350f5b5d4c405da21e2032720278ddf197f2cd3c2420b137cc3869b6881aa964c200056a1df88fe8a7e73bda72b4a5740ed4060ca97af90d01060
SSDEEP

12288:9nHtGgozqi5paO0lp9USQVUSyrkA4HZ6J+v5NdTgxWaSTA0:hN2eas1USImaHIwPuIaST7

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
\Windows\SysWOW64\conim.exe	modiloader_stage2
behavioral1/memory/1932-10-0x0000000000400000-0x00000000004B4000-memory.dmp	modiloader_stage2
behavioral1/memory/2752-18-0x0000000000400000-0x00000000004B4000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2384 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

conim.exe

pid process

1932 conim.exe
Loads dropped DLL 2 IoCs

Processes:

008ffcd20d2f024ec73058b2e7c11845_JaffaCakes118.exe

pid process

2752 008ffcd20d2f024ec73058b2e7c11845_JaffaCakes118.exe
2752 008ffcd20d2f024ec73058b2e7c11845_JaffaCakes118.exe

pid	process
2384	cmd.exe

pid	process
1932	conim.exe

pid	process
2752	008ffcd20d2f024ec73058b2e7c11845_JaffaCakes118.exe
2752	008ffcd20d2f024ec73058b2e7c11845_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

Processes:

008ffcd20d2f024ec73058b2e7c11845_JaffaCakes118.execonim.exe

description	ioc	process
File created	C:\Windows\SysWOW64\conim.exe	008ffcd20d2f024ec73058b2e7c11845_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\conim.exe	008ffcd20d2f024ec73058b2e7c11845_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\conim.exe	conim.exe
File created	C:\Windows\SysWOW64\DaverDel.bat	008ffcd20d2f024ec73058b2e7c11845_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

008ffcd20d2f024ec73058b2e7c11845_JaffaCakes118.exe

description	pid	process	target process
PID 2752 wrote to memory of 1932	2752	008ffcd20d2f024ec73058b2e7c11845_JaffaCakes118.exe	conim.exe
PID 2752 wrote to memory of 1932	2752	008ffcd20d2f024ec73058b2e7c11845_JaffaCakes118.exe	conim.exe
PID 2752 wrote to memory of 1932	2752	008ffcd20d2f024ec73058b2e7c11845_JaffaCakes118.exe	conim.exe
PID 2752 wrote to memory of 1932	2752	008ffcd20d2f024ec73058b2e7c11845_JaffaCakes118.exe	conim.exe
PID 2752 wrote to memory of 2384	2752	008ffcd20d2f024ec73058b2e7c11845_JaffaCakes118.exe	cmd.exe
PID 2752 wrote to memory of 2384	2752	008ffcd20d2f024ec73058b2e7c11845_JaffaCakes118.exe	cmd.exe
PID 2752 wrote to memory of 2384	2752	008ffcd20d2f024ec73058b2e7c11845_JaffaCakes118.exe	cmd.exe
PID 2752 wrote to memory of 2384	2752	008ffcd20d2f024ec73058b2e7c11845_JaffaCakes118.exe	cmd.exe

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Windows\system32\DaverDel.bat
2⤵
- Deletes itself
PID:2384

C:\Windows\SysWOW64\DaverDel.bat
Filesize
212B

MD5
e2182b9e278e633a1d7da8d0d95965e9

SHA1
94bc5bbf7f427ff0f0882cc7d8a4724edf86f65b

SHA256
e27df7423e8d71555c1ceffe646d2358b634bc2d220398a46bd254964dcc60cb

SHA512
033371656ed018e5930ea1d7134d9af4ff461a74aa26a54a3230c253fc28bced40ae1675956bed8d0df378bb32bf7f24f1f4f9ecc5cee43fdae3d0f2ca9fff00

Download Submit
\Windows\SysWOW64\conim.exe
Filesize
694KB

MD5
008ffcd20d2f024ec73058b2e7c11845

SHA1
58edd707567361a9f4976333ab79217be2e7fddf

SHA256
d0410fd3d546c16e89ad8216993a0a5a8a58da2f7cf909125f5109f649b81619

SHA512
c47d2a23cb2350f5b5d4c405da21e2032720278ddf197f2cd3c2420b137cc3869b6881aa964c200056a1df88fe8a7e73bda72b4a5740ed4060ca97af90d01060

Download Submit
memory/1932-10-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2752-18-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download