modiloader | 0f74d830071bd375c7228d943e93ab2c4fe0ade6168640abdd1b62a9c684a9c2

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 20:58

Target

0077b200e4057a183603bcc2d3403e5d_JaffaCakes118.dll
Size

216KB
MD5

0077b200e4057a183603bcc2d3403e5d
SHA1

9243b803bb1e77a3b4420fe555e09099210238a1
SHA256

0f74d830071bd375c7228d943e93ab2c4fe0ade6168640abdd1b62a9c684a9c2
SHA512

869f7b0e93cb06f68285b1c9c3928b9e229e98da5914d5c63c78e9677b7ba9a11528364b078abd994238570988048ae50bb2ff963b2f246315b70e8f46f2bf38
SSDEEP

3072:jkG6s4mal+3SWAjVyz8QI17ekQmehyHLvUk0rOqcfXkkCXW1sLea9ImPtG16Jg/K:jys4mXzNz8J3vUkYOTc4sz9hG1a

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1548-0-0x0000000000170000-0x00000000001AB000-memory.dmp	modiloader_stage2

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1368 wrote to memory of 1548	1368	rundll32.exe	rundll32.exe
PID 1368 wrote to memory of 1548	1368	rundll32.exe	rundll32.exe
PID 1368 wrote to memory of 1548	1368	rundll32.exe	rundll32.exe
PID 1368 wrote to memory of 1548	1368	rundll32.exe	rundll32.exe
PID 1368 wrote to memory of 1548	1368	rundll32.exe	rundll32.exe
PID 1368 wrote to memory of 1548	1368	rundll32.exe	rundll32.exe
PID 1368 wrote to memory of 1548	1368	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0077b200e4057a183603bcc2d3403e5d_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0077b200e4057a183603bcc2d3403e5d_JaffaCakes118.dll,#1
2⤵
PID:1548

memory/1548-0-0x0000000000170000-0x00000000001AB000-memory.dmp

Filesize
236KB

Download