modiloader | e25f350170fe141ed643b1b37053731a60313d8f35c3906558b9212d2cf89c20

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02275e3937342d99d86e205cfdf16d6d_JaffaCakes118.exe
Size

615KB
MD5

02275e3937342d99d86e205cfdf16d6d
SHA1

88f81db05aa516e3972a2e12b38d6b288fd43ee6
SHA256

e25f350170fe141ed643b1b37053731a60313d8f35c3906558b9212d2cf89c20
SHA512

c18a28d42f21b18ea6e9dd1c93674d4ae4947e9703c9b0ca3b91629619b77a3877a477264257f9aa3c60d3f074b02318b4c0ddd79c7af0171f716a413cc94a6e
SSDEEP

12288:lrngdXcwBEoutn4EbgUw5pUhRLTfgrvJutF3Z4mxx8DqVTVOC+:lrngRcULuthk8tT4rgtQmXbVTz+

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4780-63-0x0000000000400000-0x00000000005B2000-memory.dmp	modiloader_stage2
behavioral2/memory/4780-64-0x0000000000400000-0x00000000005B2000-memory.dmp	modiloader_stage2

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
3220	4780	WerFault.exe	02275e3937342d99d86e205cfdf16d6d_JaffaCakes118.exe
3956	4780	WerFault.exe	02275e3937342d99d86e205cfdf16d6d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\02275e3937342d99d86e205cfdf16d6d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02275e3937342d99d86e205cfdf16d6d_JaffaCakes118.exe"
1⤵
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 324
2⤵
- Program crash
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 612
2⤵
- Program crash
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4780 -ip 4780
1⤵
PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4780 -ip 4780
1⤵
PID:4272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4780-0-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/4780-1-0x0000000000AC0000-0x0000000000B14000-memory.dmp

Filesize
336KB

Download
memory/4780-14-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4780-13-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4780-43-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-63-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/4780-62-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-61-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-60-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-59-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-58-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-57-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-56-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-55-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-54-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-53-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-52-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-51-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-50-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-49-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-48-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-47-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-46-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-45-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-44-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-42-0x00000000033F0000-0x000000000340B000-memory.dmp

Filesize
108KB

Download
memory/4780-41-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-40-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-17-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-15-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4780-12-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4780-11-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4780-10-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/4780-9-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/4780-7-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/4780-39-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-38-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-37-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-36-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-35-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-34-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-33-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-6-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/4780-32-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-5-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4780-31-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-30-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-29-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-28-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-27-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-26-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-25-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-24-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-23-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-22-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-21-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-20-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-19-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-18-0x00000000033F0000-0x00000000033F1000-memory.dmp

Filesize
4KB

Download
memory/4780-16-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/4780-8-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/4780-4-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/4780-3-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4780-2-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/4780-64-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/4780-65-0x0000000000AC0000-0x0000000000B14000-memory.dmp

Filesize
336KB

Download