modiloader | ae946b117f925e3490e18c9a5dc9afaa04a1ebe99457dda4daf2ed2e87f89cfa

Analysis

max time kernel
140s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 02:35

Target

0215392ce413e1c32fb36ccae96724b2_JaffaCakes118.exe
Size

24KB
MD5

0215392ce413e1c32fb36ccae96724b2
SHA1

ee9eba85e95657336a2fdbdb03a5b6624e06c496
SHA256

ae946b117f925e3490e18c9a5dc9afaa04a1ebe99457dda4daf2ed2e87f89cfa
SHA512

38893d0ac4093c03438dd31395355c89de92c152674fcc36d1b7feab14052dfcd9b38f223377adb4c738a1e1ae94017e35167b870470f3c651b10b9fdf440b06
SSDEEP

384:CKj7Wmqzu/RQ+mLyvXYu5+z0Y3w9AwzguPE+o6n6t+aFytTw6FHN:Djh+upC2/kzw9AwzTEn6n6tnm06Ft

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1508-6-0x0000000000400000-0x0000000000423000-memory.dmp	modiloader_stage2
behavioral2/memory/3196-15-0x0000000000400000-0x0000000000423000-memory.dmp	modiloader_stage2
behavioral2/memory/1508-18-0x0000000000400000-0x0000000000423000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

winwl.exe

pid process

1508 winwl.exe
Loads dropped DLL 2 IoCs

Processes:

winwl.exe

pid process

1508 winwl.exe
1508 winwl.exe

pid	process
1508	winwl.exe

pid	process
1508	winwl.exe
1508	winwl.exe

Drops file in Windows directory 5 IoCs

Processes:

winwl.exe0215392ce413e1c32fb36ccae96724b2_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\kulionwl.dll	winwl.exe
File created	C:\Windows\winwl.exe	winwl.exe
File created	C:\Windows\kulionwl.dll	0215392ce413e1c32fb36ccae96724b2_JaffaCakes118.exe
File created	C:\Windows\winwl.exe	0215392ce413e1c32fb36ccae96724b2_JaffaCakes118.exe
File opened for modification	C:\Windows\winwl.exe	0215392ce413e1c32fb36ccae96724b2_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

winwl.exe

pid process

1508 winwl.exe

pid	process
1508	winwl.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0215392ce413e1c32fb36ccae96724b2_JaffaCakes118.exe

description	pid	process	target process
PID 3196 wrote to memory of 1508	3196	0215392ce413e1c32fb36ccae96724b2_JaffaCakes118.exe	winwl.exe
PID 3196 wrote to memory of 1508	3196	0215392ce413e1c32fb36ccae96724b2_JaffaCakes118.exe	winwl.exe
PID 3196 wrote to memory of 1508	3196	0215392ce413e1c32fb36ccae96724b2_JaffaCakes118.exe	winwl.exe

C:\Windows\kulionwl.dll
Filesize
27KB

MD5
75b2239d571212f7f6b3067b18d3cd36

SHA1
3e2ec96266892f58f22d2ce4f7d757e66aa5b038

SHA256
ffb59098553c2b280965e34857958798ea4efa362229bb37e9fe146d787c24f4

SHA512
8a3a0f59d19209b2de1eed8e58a38b88017e8ff581b7cdf88006a86edd88f6b8fcb7cd7e906d8ab7f60cadc19c72bc43182b53a7c2b3a5d2ff59267cd22928be

Download Submit
C:\Windows\winwl.exe
Filesize
24KB

MD5
0215392ce413e1c32fb36ccae96724b2

SHA1
ee9eba85e95657336a2fdbdb03a5b6624e06c496

SHA256
ae946b117f925e3490e18c9a5dc9afaa04a1ebe99457dda4daf2ed2e87f89cfa

SHA512
38893d0ac4093c03438dd31395355c89de92c152674fcc36d1b7feab14052dfcd9b38f223377adb4c738a1e1ae94017e35167b870470f3c651b10b9fdf440b06

Download Submit
memory/1508-6-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1508-12-0x00000000007E0000-0x00000000007ED000-memory.dmp

Filesize
52KB

Download
memory/1508-16-0x00000000007E0000-0x00000000007ED000-memory.dmp

Filesize
52KB

Download
memory/1508-18-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3196-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3196-15-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download