modiloader | 4026fb3aef4c0912a65926ea1e485a1847ed88d03427ecb162491c637cc00d23

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 01:15

Target

01a6296651ea5381a4b17d610f5fc8bf_JaffaCakes118.exe
Size

26KB
MD5

01a6296651ea5381a4b17d610f5fc8bf
SHA1

23bdb1beadc51099e40628c112100bb454a78b25
SHA256

4026fb3aef4c0912a65926ea1e485a1847ed88d03427ecb162491c637cc00d23
SHA512

38b20b67c536e78aad0bede8731b431cdd53eea31b0a8f26169609edf13808a795128641c4ecc06d16d09f40827a1d225d9f6b7f1840170f1e4aeb1e926abe99
SSDEEP

384:7KoA0iaVZAszu/RQ+mLyvXYu5+z0VHIfAt8WQDgKT8ZLkbi6uPnjbTH858b6uxNr:OoTHupC2/kkt2Q9kG9no5QxF

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2204-0-0x0000000000400000-0x0000000000424000-memory.dmp	modiloader_stage2
behavioral1/memory/2332-13-0x0000000000400000-0x0000000000424000-memory.dmp	modiloader_stage2
behavioral1/memory/2204-12-0x0000000000400000-0x0000000000424000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

winow.exe

pid process

2332 winow.exe

pid	process
2332	winow.exe

Drops file in Windows directory 5 IoCs

Processes:

01a6296651ea5381a4b17d610f5fc8bf_JaffaCakes118.exewinow.exe

description	ioc	process
File created	C:\Windows\winow.dll	01a6296651ea5381a4b17d610f5fc8bf_JaffaCakes118.exe
File created	C:\Windows\winow.exe	01a6296651ea5381a4b17d610f5fc8bf_JaffaCakes118.exe
File opened for modification	C:\Windows\winow.exe	01a6296651ea5381a4b17d610f5fc8bf_JaffaCakes118.exe
File created	C:\Windows\winow.dll	winow.exe
File created	C:\Windows\winow.exe	winow.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

01a6296651ea5381a4b17d610f5fc8bf_JaffaCakes118.exe

description	pid	process	target process
PID 2204 wrote to memory of 2332	2204	01a6296651ea5381a4b17d610f5fc8bf_JaffaCakes118.exe	winow.exe
PID 2204 wrote to memory of 2332	2204	01a6296651ea5381a4b17d610f5fc8bf_JaffaCakes118.exe	winow.exe
PID 2204 wrote to memory of 2332	2204	01a6296651ea5381a4b17d610f5fc8bf_JaffaCakes118.exe	winow.exe
PID 2204 wrote to memory of 2332	2204	01a6296651ea5381a4b17d610f5fc8bf_JaffaCakes118.exe	winow.exe

C:\Windows\winow.dll

Filesize
31KB

MD5
73cdbd720b037ffd497d026e03fc9fbf

SHA1
a71ddf48ab5298ba0761dcfcb7074ebb7c42392c

SHA256
0b9577fc2ab99e39e95aa5156a8891a25c98c26a29767272779d2d66c54afb58

SHA512
967124d96461813cc58987809b9f36d0b5d001d59ab3cf508e68bb7453ed0178001723bd3d855713e49909b028ad7a2ecde2555c87fad2256bb6b251a7d22782

Download Submit
C:\Windows\winow.exe

Filesize
26KB

MD5
01a6296651ea5381a4b17d610f5fc8bf

SHA1
23bdb1beadc51099e40628c112100bb454a78b25

SHA256
4026fb3aef4c0912a65926ea1e485a1847ed88d03427ecb162491c637cc00d23

SHA512
38b20b67c536e78aad0bede8731b431cdd53eea31b0a8f26169609edf13808a795128641c4ecc06d16d09f40827a1d225d9f6b7f1840170f1e4aeb1e926abe99

Download Submit
memory/2204-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2204-4-0x0000000000250000-0x0000000000274000-memory.dmp

Filesize
144KB

Download
memory/2204-9-0x0000000000250000-0x0000000000274000-memory.dmp

Filesize
144KB

Download
memory/2204-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2332-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download