modiloader | a3751773e45f1c053a46d24fddb6e28761730a1220cf3b984ee9a509268426f3

General

Target

026e6b7587d74eaf2541312e58cbcb16_JaffaCakes118.exe
Size

548KB
MD5

026e6b7587d74eaf2541312e58cbcb16
SHA1

114e256af23b8f70e2d74c53a791f9d87211cd2f
SHA256

a3751773e45f1c053a46d24fddb6e28761730a1220cf3b984ee9a509268426f3
SHA512

de50df70140b13a2e3a2f5abc1b9a39bd93aea6febb94403b5b947f15bd317a37f9c4a60ba4959113cc2b0b462afb06121b2e289fd6c8c907c5be4c3f32f844f
SSDEEP

12288:Zq6rNnJcjLzuMc2Bt+ajBcxy3+F3Z4mxxvK6e4MTJU/hj:ZnRJa3aWdjBiQmXvuNq/N

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1720-32-0x0000000000400000-0x00000000004E0000-memory.dmp	modiloader_stage2

Drops file in System32 directory 1 IoCs

Processes:

026e6b7587d74eaf2541312e58cbcb16_JaffaCakes118.exe

description ioc process

File created C:\Windows\SysWOW64\Setupddos.txt 026e6b7587d74eaf2541312e58cbcb16_JaffaCakes118.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2588 1720 WerFault.exe 026e6b7587d74eaf2541312e58cbcb16_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Setupddos.txt	026e6b7587d74eaf2541312e58cbcb16_JaffaCakes118.exe

pid	pid_target	process	target process
2588	1720	WerFault.exe	026e6b7587d74eaf2541312e58cbcb16_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

026e6b7587d74eaf2541312e58cbcb16_JaffaCakes118.exe

description	pid	process	target process
PID 1720 wrote to memory of 2664	1720	026e6b7587d74eaf2541312e58cbcb16_JaffaCakes118.exe	IEXPLORE.EXE
PID 1720 wrote to memory of 2664	1720	026e6b7587d74eaf2541312e58cbcb16_JaffaCakes118.exe	IEXPLORE.EXE
PID 1720 wrote to memory of 2664	1720	026e6b7587d74eaf2541312e58cbcb16_JaffaCakes118.exe	IEXPLORE.EXE
PID 1720 wrote to memory of 2664	1720	026e6b7587d74eaf2541312e58cbcb16_JaffaCakes118.exe	IEXPLORE.EXE
PID 1720 wrote to memory of 2588	1720	026e6b7587d74eaf2541312e58cbcb16_JaffaCakes118.exe	WerFault.exe
PID 1720 wrote to memory of 2588	1720	026e6b7587d74eaf2541312e58cbcb16_JaffaCakes118.exe	WerFault.exe
PID 1720 wrote to memory of 2588	1720	026e6b7587d74eaf2541312e58cbcb16_JaffaCakes118.exe	WerFault.exe
PID 1720 wrote to memory of 2588	1720	026e6b7587d74eaf2541312e58cbcb16_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\026e6b7587d74eaf2541312e58cbcb16_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\026e6b7587d74eaf2541312e58cbcb16_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1720

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
2⤵
PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 256
2⤵
- Program crash
PID:2588

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-7-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1720-16-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1720-27-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/1720-26-0x0000000001F10000-0x0000000001F11000-memory.dmp

Filesize
4KB

Download
memory/1720-30-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1720-29-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1720-28-0x00000000031F0000-0x00000000031F2000-memory.dmp

Filesize
8KB

Download
memory/1720-25-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/1720-24-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1720-23-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/1720-22-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/1720-21-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1720-20-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/1720-19-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/1720-18-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/1720-17-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/1720-15-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/1720-14-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/1720-13-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/1720-12-0x0000000003200000-0x0000000003202000-memory.dmp

Filesize
8KB

Download
memory/1720-11-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1720-10-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/1720-9-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/1720-8-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/1720-6-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1720-5-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1720-4-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1720-3-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/1720-2-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/1720-1-0x0000000000340000-0x0000000000394000-memory.dmp

Filesize
336KB

Download
memory/1720-0-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1720-32-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1720-33-0x0000000000340000-0x0000000000394000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads