modiloader | 58edab62e6445b328ec5cacff8770cba35b734428c8cc032608c710d3427110b

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 08:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0453e377af0cc62edba4bbfc9b6a2d33_JaffaCakes118.exe
Size 687KB
Sample240620-kagpgaxgjf
SHA256 58edab62e6445b328ec5cacff8770cba35b734428c8cc032608c710d3427110b
MD5 0453e377af0cc62edba4bbfc9b6a2d33
SHA1 9a8ec7110cd4087247c776ee2015e66926710574
SHA512 754a658e43303c9b815e326ed96160a81462959b6f6d1ba0bdf3be70a131810482e01db143759d66deeb1c94964d5e3021552bbfe4b086df852a5fd71bfd337d
SSDEEP 12288:lslIdvbfEk2Q6ByxuzwtKOoWdgavlbbF1gii9SU9mOSgYL765Oj2K/QNwX:lsqbHTmRLOougqbFi2L76cjTIOX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/4184-5-0x0000000000400000-0x00000000004BF200-memory.dmp	modiloader_stage2

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SetupWay.TXT	0453e377af0cc62edba4bbfc9b6a2d33_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4184 set thread context of 4364	4184	0453e377af0cc62edba4bbfc9b6a2d33_JaffaCakes118.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4704	4364	WerFault.exe	82

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4364	4184	0453e377af0cc62edba4bbfc9b6a2d33_JaffaCakes118.exe	82
PID 4184 wrote to memory of 4364	4184	0453e377af0cc62edba4bbfc9b6a2d33_JaffaCakes118.exe	82
PID 4184 wrote to memory of 4364	4184	0453e377af0cc62edba4bbfc9b6a2d33_JaffaCakes118.exe	82
PID 4184 wrote to memory of 4364	4184	0453e377af0cc62edba4bbfc9b6a2d33_JaffaCakes118.exe	82
PID 4184 wrote to memory of 4364	4184	0453e377af0cc62edba4bbfc9b6a2d33_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\0453e377af0cc62edba4bbfc9b6a2d33_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0453e377af0cc62edba4bbfc9b6a2d33_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  PID:4364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 12
    3⤵
    - Program crash
    PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4364 -ip 4364
1⤵
PID:640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4184-0-0x0000000000400000-0x00000000004BF200-memory.dmp

Download

memory/4184-2-0x0000000002340000-0x0000000002341000-memory.dmp

Download

memory/4184-5-0x0000000000400000-0x00000000004BF200-memory.dmp

Download

memory/4364-3-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads