modiloader | 12f75c738097b147c9de591a65b1f99b8cf9fcfe339b01c44f0184df2750a21d

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 04:12

Target

02b5b822f4a4f1ceb9f0fa7715b341c8_JaffaCakes118.exe
Size

711KB
MD5

02b5b822f4a4f1ceb9f0fa7715b341c8
SHA1

22e4a910e73d9752b97ed4f730863c28f5589805
SHA256

12f75c738097b147c9de591a65b1f99b8cf9fcfe339b01c44f0184df2750a21d
SHA512

38a82a6437da0eaa692196a3fbe91f3f9045768bdecbe3bdf9e766c969ba1b85e2141233a1aff67e0f026e53789f3934e58e1a3c2e7bde0f190f8af81d977a78
SSDEEP

12288:8JTE2MTJvuku7RzjPaMeRZOCfRSHZaQIO/PLF3Z4mxxl4i2spjsr5WwT:aE2MTs9jbeRZOC5SQQIO3LQmXVdunT

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1684-3-0x0000000000400000-0x000000000051E000-memory.dmp	modiloader_stage2
behavioral1/memory/1684-5-0x0000000000400000-0x000000000051E000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

Processes:

02b5b822f4a4f1ceb9f0fa7715b341c8_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt	02b5b822f4a4f1ceb9f0fa7715b341c8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

02b5b822f4a4f1ceb9f0fa7715b341c8_JaffaCakes118.exe

description	pid	process	target process
PID 1684 wrote to memory of 836	1684	02b5b822f4a4f1ceb9f0fa7715b341c8_JaffaCakes118.exe	IEXPLORE.EXE
PID 1684 wrote to memory of 836	1684	02b5b822f4a4f1ceb9f0fa7715b341c8_JaffaCakes118.exe	IEXPLORE.EXE
PID 1684 wrote to memory of 836	1684	02b5b822f4a4f1ceb9f0fa7715b341c8_JaffaCakes118.exe	IEXPLORE.EXE
PID 1684 wrote to memory of 836	1684	02b5b822f4a4f1ceb9f0fa7715b341c8_JaffaCakes118.exe	IEXPLORE.EXE

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
2⤵
PID:836

memory/1684-0-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1684-1-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1684-3-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1684-5-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1684-6-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download