modiloader | 3497176d4f9ee31403740c368cdef6a11a8177e281b0b528f7ca996c7bb1c7c4

Analysis

max time kernel
135s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 07:04

Target

03deb3a3e448c2e02fbb52e23ac7f892_JaffaCakes118.exe
Size

457KB
MD5

03deb3a3e448c2e02fbb52e23ac7f892
SHA1

b9712587a1cbd2ea2abe6b3f2e5ca9c595bd4ec0
SHA256

3497176d4f9ee31403740c368cdef6a11a8177e281b0b528f7ca996c7bb1c7c4
SHA512

e3b542c4fc1d77b66f714dc755291642913e354db97af9d93a33a2b1f338b1501f031dad659990be03a55be51b40d73baba094c5c924e8572d6ff51d0f261999
SSDEEP

12288:PjWeTasKE+aYYppnUyk1qb+VMPbJKKn+oGYSr:P6eT7KEgApUAw+FGYSr

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4540-3-0x0000000000400000-0x00000000004D7F10-memory.dmp	modiloader_stage2

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

03deb3a3e448c2e02fbb52e23ac7f892_JaffaCakes118.exe

pid process

4540 03deb3a3e448c2e02fbb52e23ac7f892_JaffaCakes118.exe
4540 03deb3a3e448c2e02fbb52e23ac7f892_JaffaCakes118.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2940 4540 WerFault.exe 03deb3a3e448c2e02fbb52e23ac7f892_JaffaCakes118.exe

pid	process
4540	03deb3a3e448c2e02fbb52e23ac7f892_JaffaCakes118.exe
4540	03deb3a3e448c2e02fbb52e23ac7f892_JaffaCakes118.exe

pid	pid_target	process	target process
2940	4540	WerFault.exe	03deb3a3e448c2e02fbb52e23ac7f892_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\03deb3a3e448c2e02fbb52e23ac7f892_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03deb3a3e448c2e02fbb52e23ac7f892_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 540
2⤵
- Program crash
PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4540 -ip 4540
1⤵
PID:5080

memory/4540-0-0x00000000004C2000-0x00000000004D8000-memory.dmp

Filesize
88KB

Download
memory/4540-1-0x00000000004C2000-0x00000000004D8000-memory.dmp

Filesize
88KB

Download
memory/4540-2-0x0000000000400000-0x00000000004D7F10-memory.dmp

Filesize
863KB

Download
memory/4540-3-0x0000000000400000-0x00000000004D7F10-memory.dmp

Filesize
863KB

Download