modiloader | 95f8771a24a127028a96dd8c128c0d576f7cfd08d51fe7e872f44712bae7a5ab

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 04:11

Target

02b4a6d119d91ee4abe71f9220f1b4f2_JaffaCakes118.exe
Size

423KB
MD5

02b4a6d119d91ee4abe71f9220f1b4f2
SHA1

9d0843c36d25ab8b0fd904a38dc3650d0744c2e1
SHA256

95f8771a24a127028a96dd8c128c0d576f7cfd08d51fe7e872f44712bae7a5ab
SHA512

5c3ebe11e1aae4b973f8ecc7cbb20dfd58ef652aedfa12d8f2e1d236b7cf2d6868bcb9b918598e65099b8384837f7d68b7310a0e65cbd42292515dc9c2b5c216
SSDEEP

12288:lz1aGpjRJpPVNXsiZJ00mSj0QEimmZg4pGoIVNM:lz1aGpjnp9NXrZJXmW0QEbmZnpGoIVN

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/1684-3-0x0000000000400000-0x000000000052C000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt	02b4a6d119d91ee4abe71f9220f1b4f2_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1224	1684	WerFault.exe	27

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1944	1684	02b4a6d119d91ee4abe71f9220f1b4f2_JaffaCakes118.exe	28
PID 1684 wrote to memory of 1944	1684	02b4a6d119d91ee4abe71f9220f1b4f2_JaffaCakes118.exe	28
PID 1684 wrote to memory of 1944	1684	02b4a6d119d91ee4abe71f9220f1b4f2_JaffaCakes118.exe	28
PID 1684 wrote to memory of 1944	1684	02b4a6d119d91ee4abe71f9220f1b4f2_JaffaCakes118.exe	28
PID 1684 wrote to memory of 1224	1684	02b4a6d119d91ee4abe71f9220f1b4f2_JaffaCakes118.exe	29
PID 1684 wrote to memory of 1224	1684	02b4a6d119d91ee4abe71f9220f1b4f2_JaffaCakes118.exe	29
PID 1684 wrote to memory of 1224	1684	02b4a6d119d91ee4abe71f9220f1b4f2_JaffaCakes118.exe	29
PID 1684 wrote to memory of 1224	1684	02b4a6d119d91ee4abe71f9220f1b4f2_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\02b4a6d119d91ee4abe71f9220f1b4f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02b4a6d119d91ee4abe71f9220f1b4f2_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1684
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:1944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 292
  2⤵
  - Program crash
  PID:1224

memory/1684-0-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/1684-2-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1684-3-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download