modiloader | 4564a3d0650a5cc02b033f5e866a86f5e709a094ba5b617f726d0833db9e80bc

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 04:41

Target

02e19ab1b09310b3f98583fa8167cf7c_JaffaCakes118.exe
Size

23KB
MD5

02e19ab1b09310b3f98583fa8167cf7c
SHA1

3603c7b622eb6979142396b75f92e22373ebf448
SHA256

4564a3d0650a5cc02b033f5e866a86f5e709a094ba5b617f726d0833db9e80bc
SHA512

bf3cd4429c515a6559a1427272b1f5c632d80405d030279fee4e4b2ca98f16e2a83a7b699e61495af849f425689e1d9d5e5a049ebae21c3c12e1f573bdac595d
SSDEEP

384:EgSRGOuu9L3KK2esfQZMlpwfJeqgOgWYpIlRVZENoKNLn3J8BtUGkXVf:ETRzRjYfQZMl+EUKoSiOXt

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3164-10-0x0000000000400000-0x0000000000416000-memory.dmp	modiloader_stage2
behavioral2/memory/496-11-0x0000000000400000-0x0000000000416000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

tcpip.exe

pid process

496 tcpip.exe

pid	process
496	tcpip.exe

Drops file in System32 directory 4 IoCs

Processes:

02e19ab1b09310b3f98583fa8167cf7c_JaffaCakes118.exetcpip.exe

description	ioc	process
File created	C:\Windows\SysWOW64\tcpip.exe	02e19ab1b09310b3f98583fa8167cf7c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\tcpip.exe	02e19ab1b09310b3f98583fa8167cf7c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ygdtw.bat	02e19ab1b09310b3f98583fa8167cf7c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\portablemsi.dll	tcpip.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

02e19ab1b09310b3f98583fa8167cf7c_JaffaCakes118.exetcpip.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

02e19ab1b09310b3f98583fa8167cf7c_JaffaCakes118.exetcpip.exe

description pid process

Token: SeDebugPrivilege 3164 02e19ab1b09310b3f98583fa8167cf7c_JaffaCakes118.exe
Token: SeDebugPrivilege 496 tcpip.exe

description	pid	process
Token: SeDebugPrivilege	3164	02e19ab1b09310b3f98583fa8167cf7c_JaffaCakes118.exe
Token: SeDebugPrivilege	496	tcpip.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

02e19ab1b09310b3f98583fa8167cf7c_JaffaCakes118.exetcpip.exe

description	pid	process	target process
PID 3164 wrote to memory of 4828	3164	02e19ab1b09310b3f98583fa8167cf7c_JaffaCakes118.exe	cmd.exe
PID 3164 wrote to memory of 4828	3164	02e19ab1b09310b3f98583fa8167cf7c_JaffaCakes118.exe	cmd.exe
PID 3164 wrote to memory of 4828	3164	02e19ab1b09310b3f98583fa8167cf7c_JaffaCakes118.exe	cmd.exe
PID 496 wrote to memory of 3512	496	tcpip.exe	Explorer.EXE

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\ygdtw.bat
3⤵
PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:2212

C:\Windows\SysWOW64\tcpip.exe
Filesize
23KB

MD5
02e19ab1b09310b3f98583fa8167cf7c

SHA1
3603c7b622eb6979142396b75f92e22373ebf448

SHA256
4564a3d0650a5cc02b033f5e866a86f5e709a094ba5b617f726d0833db9e80bc

SHA512
bf3cd4429c515a6559a1427272b1f5c632d80405d030279fee4e4b2ca98f16e2a83a7b699e61495af849f425689e1d9d5e5a049ebae21c3c12e1f573bdac595d

Download Submit
C:\Windows\SysWOW64\ygdtw.bat
Filesize
214B

MD5
10b13d1904f21f00d39f0004a19efbdd

SHA1
e3580e8738ca545722534f60f8aa908bb074643f

SHA256
57370abb3b588d4eb979780f09008c40f8dcff74e9e44101e7a8b1c64b4b8b6d

SHA512
12bd9201a5961d3896a9a01e71cd0b5cac1513522fd814eba78f183274fd319cd80d8c5a194f9e3a18d5e30ab5ec529ea966717846e534a1cf35a6fd1df3d8cb

Download Submit
memory/496-5-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/496-11-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3164-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3164-1-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/3164-10-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download