modiloader | fa8642ddc68bd605f1f5ab99c0beaef95a3eeed729a3df08e4044b3250c656ee

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 05:38

Target

034b7c054f0451823712feb207172d87_JaffaCakes118.dll
Size

21KB
MD5

034b7c054f0451823712feb207172d87
SHA1

3bd5d63c3830cbf8245a330238a7c4f846f5272d
SHA256

fa8642ddc68bd605f1f5ab99c0beaef95a3eeed729a3df08e4044b3250c656ee
SHA512

518876b6e5380ded61eec751df13542f8c7fb4682c31b7c64e9856fc8f4854bd7a6cb6a180421e3a931884b6f03ff8f1f26dc4c393f13bb6a28dadf363e01ab8
SSDEEP

384:Ns1DrX0hc9x4Iqdk88YZS3VvvwoqsfobTvyJbBhBC6qO/+fSaYIafwXLfnMx4lnZ:yr02r4DRvSlHQsfoXyJdjFL+XXLPARB0

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1888-0-0x0000000000400000-0x0000000000424000-memory.dmp	modiloader_stage2

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3948 wrote to memory of 1888	3948	regsvr32.exe	regsvr32.exe
PID 3948 wrote to memory of 1888	3948	regsvr32.exe	regsvr32.exe
PID 3948 wrote to memory of 1888	3948	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\034b7c054f0451823712feb207172d87_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3948

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\034b7c054f0451823712feb207172d87_JaffaCakes118.dll
2⤵
PID:1888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4012,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
1⤵
PID:4860

memory/1888-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download