modiloader | c96ed78a25d34ee7be687a9ba6b2a8e990a9c2a760e67707b433aab7e6a408e8

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 05:31

Target

033ceaa4db6af5b98c9d3c99ac93b9a6_JaffaCakes118.exe
Size

372KB
MD5

033ceaa4db6af5b98c9d3c99ac93b9a6
SHA1

8c6bbbcab313b36ad64718bc1560790f51fb21a4
SHA256

c96ed78a25d34ee7be687a9ba6b2a8e990a9c2a760e67707b433aab7e6a408e8
SHA512

9ed1e9576ff6d873df0ba00b032264b03b01380614c0b386be477e3fb284646cf2785b66141c8434d5e52226506fc6f6c00218453872e9c1d714da50fdf56aa3
SSDEEP

6144:l7pwL/Q/ZFdW4euJYmCsj70XVHtfugew/+6bvd6DSyVNW0W94JEVU50:VpY/QHdW43CsjIF4gewW6rdV0NW0WGJI

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1740-1-0x0000000000400000-0x0000000000514000-memory.dmp	modiloader_stage2
behavioral1/memory/1740-5-0x0000000000400000-0x0000000000514000-memory.dmp	modiloader_stage2
behavioral1/memory/2012-17-0x0000000000400000-0x0000000000514000-memory.dmp	modiloader_stage2
behavioral1/memory/2012-18-0x0000000000400000-0x0000000000514000-memory.dmp	modiloader_stage2
behavioral1/memory/1740-19-0x0000000000400000-0x0000000000514000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

rejoice47.exe

pid process

2012 rejoice47.exe
Loads dropped DLL 2 IoCs

Processes:

033ceaa4db6af5b98c9d3c99ac93b9a6_JaffaCakes118.exe

pid process

1740 033ceaa4db6af5b98c9d3c99ac93b9a6_JaffaCakes118.exe
1740 033ceaa4db6af5b98c9d3c99ac93b9a6_JaffaCakes118.exe

pid	process
2012	rejoice47.exe

pid	process
1740	033ceaa4db6af5b98c9d3c99ac93b9a6_JaffaCakes118.exe
1740	033ceaa4db6af5b98c9d3c99ac93b9a6_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

Processes:

033ceaa4db6af5b98c9d3c99ac93b9a6_JaffaCakes118.exerejoice47.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rejoice47.exe	033ceaa4db6af5b98c9d3c99ac93b9a6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rejoice47.exe	033ceaa4db6af5b98c9d3c99ac93b9a6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rejoice47.exe	rejoice47.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

033ceaa4db6af5b98c9d3c99ac93b9a6_JaffaCakes118.exe

description	pid	process	target process
PID 1740 wrote to memory of 2012	1740	033ceaa4db6af5b98c9d3c99ac93b9a6_JaffaCakes118.exe	rejoice47.exe
PID 1740 wrote to memory of 2012	1740	033ceaa4db6af5b98c9d3c99ac93b9a6_JaffaCakes118.exe	rejoice47.exe
PID 1740 wrote to memory of 2012	1740	033ceaa4db6af5b98c9d3c99ac93b9a6_JaffaCakes118.exe	rejoice47.exe
PID 1740 wrote to memory of 2012	1740	033ceaa4db6af5b98c9d3c99ac93b9a6_JaffaCakes118.exe	rejoice47.exe

\Windows\SysWOW64\rejoice47.exe
Filesize
372KB

MD5
033ceaa4db6af5b98c9d3c99ac93b9a6

SHA1
8c6bbbcab313b36ad64718bc1560790f51fb21a4

SHA256
c96ed78a25d34ee7be687a9ba6b2a8e990a9c2a760e67707b433aab7e6a408e8

SHA512
9ed1e9576ff6d873df0ba00b032264b03b01380614c0b386be477e3fb284646cf2785b66141c8434d5e52226506fc6f6c00218453872e9c1d714da50fdf56aa3

Download Submit
memory/1740-0-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1740-2-0x00000000004B7000-0x0000000000513000-memory.dmp

Filesize
368KB

Download
memory/1740-1-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1740-5-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1740-7-0x0000000003050000-0x0000000003164000-memory.dmp

Filesize
1.1MB

Download
memory/1740-19-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1740-20-0x00000000004B7000-0x0000000000513000-memory.dmp

Filesize
368KB

Download
memory/2012-15-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2012-17-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2012-18-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download