modiloader | 95f8771a24a127028a96dd8c128c0d576f7cfd08d51fe7e872f44712bae7a5ab

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 04:11

Target

02b4a6d119d91ee4abe71f9220f1b4f2_JaffaCakes118.exe
Size

423KB
MD5

02b4a6d119d91ee4abe71f9220f1b4f2
SHA1

9d0843c36d25ab8b0fd904a38dc3650d0744c2e1
SHA256

95f8771a24a127028a96dd8c128c0d576f7cfd08d51fe7e872f44712bae7a5ab
SHA512

5c3ebe11e1aae4b973f8ecc7cbb20dfd58ef652aedfa12d8f2e1d236b7cf2d6868bcb9b918598e65099b8384837f7d68b7310a0e65cbd42292515dc9c2b5c216
SSDEEP

12288:lz1aGpjRJpPVNXsiZJ00mSj0QEimmZg4pGoIVNM:lz1aGpjnp9NXrZJXmW0QEbmZnpGoIVN

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/1152-4-0x0000000000400000-0x000000000052C000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt	02b4a6d119d91ee4abe71f9220f1b4f2_JaffaCakes118.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1628	1152	WerFault.exe	81
5744	1152	WerFault.exe	81

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 336	1152	02b4a6d119d91ee4abe71f9220f1b4f2_JaffaCakes118.exe	82
PID 1152 wrote to memory of 336	1152	02b4a6d119d91ee4abe71f9220f1b4f2_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\02b4a6d119d91ee4abe71f9220f1b4f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02b4a6d119d91ee4abe71f9220f1b4f2_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1152
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 600
  2⤵
  - Program crash
  PID:1628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 656
  2⤵
  - Program crash
  PID:5744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1152 -ip 1152
1⤵
PID:5408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1152 -ip 1152
1⤵
PID:2948

memory/1152-0-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/1152-2-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/1152-3-0x0000000000415000-0x0000000000416000-memory.dmp

Filesize
4KB

Download
memory/1152-4-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download