modiloader | 645acc9dc471bb6cfbffa0c27db9fc6a412cf720b6ed36cbe7bbc2a30b35d12b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 07:19

Target

03f784b1eaa3b974d4117cc74ada699f_JaffaCakes118.exe
Size

1.2MB
MD5

03f784b1eaa3b974d4117cc74ada699f
SHA1

d943f75560728cc459605855b1998a1aa81d9d26
SHA256

645acc9dc471bb6cfbffa0c27db9fc6a412cf720b6ed36cbe7bbc2a30b35d12b
SHA512

8a9347ee04addce23485583bd28b0af323e0408666d3263a6ace48ace26daa887ba42a798cb908341c475480e1e3bafe8b263070de8da5177ba50ee8d8fb8c40
SSDEEP

24576:7lw60CjfIItrrekxvYpsFQhopqVAbEcnsUr0I6CBfIpWz:yZMrGpo3zNBApWz

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2240-5-0x0000000000400000-0x0000000000528000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Fiele Ps.txt	03f784b1eaa3b974d4117cc74ada699f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2132	2240	03f784b1eaa3b974d4117cc74ada699f_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2132	2240	03f784b1eaa3b974d4117cc74ada699f_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2132	2240	03f784b1eaa3b974d4117cc74ada699f_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2132	2240	03f784b1eaa3b974d4117cc74ada699f_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\03f784b1eaa3b974d4117cc74ada699f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03f784b1eaa3b974d4117cc74ada699f_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2240
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:2132

memory/2240-0-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/2240-4-0x0000000000415000-0x0000000000416000-memory.dmp

Filesize
4KB

Download
memory/2240-5-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/2240-3-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download