modiloader | 10ec5f4adec31a4ba7834aa3776d4ff66949d96797195e81bb20bfb42d224a73

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 03:56

Target

029a122ef041a55c90434b7c6cbd8b90_JaffaCakes118.exe
Size

278KB
MD5

029a122ef041a55c90434b7c6cbd8b90
SHA1

0dfac5324183830f76754dc36b985fd1a11a485a
SHA256

10ec5f4adec31a4ba7834aa3776d4ff66949d96797195e81bb20bfb42d224a73
SHA512

04238c33e6aa4c11c442cc717d9c41516bd2c6305d92585873c8b46b4b835704fb4e29f819c8883003d4a4d6bb2ec41741d3a0d66687cd614171637dbeb25fcc
SSDEEP

6144:Zs0MrkLyqr0B/AHVy5xHgN2uv1Nsq+uIyA6Y5XdhB0S/RTYKK:VMIyqXVIxHs2OHbIyA6Y5thB0mpYb

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1752-3-0x0000000000400000-0x000000000054D000-memory.dmp	modiloader_stage2
behavioral1/memory/1752-6-0x0000000000400000-0x000000000054D000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

Processes:

029a122ef041a55c90434b7c6cbd8b90_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt	029a122ef041a55c90434b7c6cbd8b90_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

029a122ef041a55c90434b7c6cbd8b90_JaffaCakes118.exe

description	pid	process	target process
PID 1752 wrote to memory of 2068	1752	029a122ef041a55c90434b7c6cbd8b90_JaffaCakes118.exe	IEXPLORE.EXE
PID 1752 wrote to memory of 2068	1752	029a122ef041a55c90434b7c6cbd8b90_JaffaCakes118.exe	IEXPLORE.EXE
PID 1752 wrote to memory of 2068	1752	029a122ef041a55c90434b7c6cbd8b90_JaffaCakes118.exe	IEXPLORE.EXE
PID 1752 wrote to memory of 2068	1752	029a122ef041a55c90434b7c6cbd8b90_JaffaCakes118.exe	IEXPLORE.EXE

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
2⤵
PID:2068

memory/1752-0-0x0000000000400000-0x000000000054D000-memory.dmp

Filesize
1.3MB

Download
memory/1752-1-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1752-2-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1752-4-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/1752-3-0x0000000000400000-0x000000000054D000-memory.dmp

Filesize
1.3MB

Download
memory/1752-6-0x0000000000400000-0x000000000054D000-memory.dmp

Filesize
1.3MB

Download