modiloader | c3a2a615367c4146d9d18fbf212469599fec07f8ccdb38e5e8fa5036f899a6eb

Analysis

max time kernel
151s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0812ca75d13ff0ed86bc29edbed3cc94_JaffaCakes118.exe
Size 682KB
Sample240620-vpetjasfrp
SHA256 c3a2a615367c4146d9d18fbf212469599fec07f8ccdb38e5e8fa5036f899a6eb
MD5 0812ca75d13ff0ed86bc29edbed3cc94
SHA1 f05fa0e094648ad88340858e105e30b9b95699d1
SHA512 5cbdfcbb7e5bf6acb7f8bc245fed032a7914d68760b55f359d35a4b5fbfcb350a0a6989c0f7f6f815c2c658d79e821f38f25f5d2b620d643a94a49fc984849d1
SSDEEP 12288:GCak3wugOJ63b6colgOcIdA6cyhnUF3Z4mxxnsqWmXAnMECUQIZ1D6BF:Fa9ugOUr6TKsWSUQmXsPyAnMECT4gF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 5 IoCs

resource	yara_rule
behavioral2/memory/4284-32-0x0000000000400000-0x0000000000523000-memory.dmp	modiloader_stage2
behavioral2/memory/4228-33-0x0000000000400000-0x0000000000523000-memory.dmp	modiloader_stage2
behavioral2/memory/4284-42-0x0000000000400000-0x0000000000523000-memory.dmp	modiloader_stage2
behavioral2/memory/4228-45-0x0000000000400000-0x0000000000523000-memory.dmp	modiloader_stage2
behavioral2/memory/4228-46-0x0000000000400000-0x0000000000523000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
4228	winrars32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_winrars32.exe	winrars32.exe
File opened for modification	C:\Windows\SysWOW64\_winrars32.exe	winrars32.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat	0812ca75d13ff0ed86bc29edbed3cc94_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\winrars32.exe	0812ca75d13ff0ed86bc29edbed3cc94_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\winrars32.exe	0812ca75d13ff0ed86bc29edbed3cc94_JaffaCakes118.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5028	4228	WerFault.exe	90
1612	4228	WerFault.exe	90

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 4228	4284	0812ca75d13ff0ed86bc29edbed3cc94_JaffaCakes118.exe	90
PID 4284 wrote to memory of 4228	4284	0812ca75d13ff0ed86bc29edbed3cc94_JaffaCakes118.exe	90
PID 4284 wrote to memory of 4228	4284	0812ca75d13ff0ed86bc29edbed3cc94_JaffaCakes118.exe	90
PID 4228 wrote to memory of 2744	4228	winrars32.exe	91
PID 4228 wrote to memory of 2744	4228	winrars32.exe	91
PID 4228 wrote to memory of 2744	4228	winrars32.exe	91
PID 4228 wrote to memory of 5028	4228	winrars32.exe	94
PID 4228 wrote to memory of 5028	4228	winrars32.exe	94
PID 4228 wrote to memory of 5028	4228	winrars32.exe	94
PID 4284 wrote to memory of 1392	4284	0812ca75d13ff0ed86bc29edbed3cc94_JaffaCakes118.exe	98
PID 4284 wrote to memory of 1392	4284	0812ca75d13ff0ed86bc29edbed3cc94_JaffaCakes118.exe	98
PID 4284 wrote to memory of 1392	4284	0812ca75d13ff0ed86bc29edbed3cc94_JaffaCakes118.exe	98

C:\Users\Admin\AppData\Local\Temp\0812ca75d13ff0ed86bc29edbed3cc94_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0812ca75d13ff0ed86bc29edbed3cc94_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\winrars32.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\winrars32.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:2744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 664
    3⤵
    - Program crash
    PID:5028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 664
    3⤵
    - Program crash
    PID:1612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat""
  2⤵
  PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4228 -ip 4228
1⤵
PID:2656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DelSvel.bat

Path C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat
Size 212B
SHA256 960591688dcd69c1d915791a81dead50030848054ff1ab124219faffa4d7ea1f
MD5 b82da111a58e6027bafaac4780c2f6cc
SHA1 e56bae62ddf649ff2ce0821f56e8d90f6b86cdc8
SHA512 8228a6018af6c6ddb4380bcc8342bd9c62e960c3697839ff0db6a4c986e757855ab994fe0934821ab8a790e27ee5866116ee1dce2e302c527bbd129dd5033f11
MD5 SHA1 SHA512

Submit Download

winrars32.exe

Path C:\Program Files\Common Files\microsoft shared\MSInfo\winrars32.exe
Size 682KB
SHA256 c3a2a615367c4146d9d18fbf212469599fec07f8ccdb38e5e8fa5036f899a6eb
MD5 0812ca75d13ff0ed86bc29edbed3cc94
SHA1 f05fa0e094648ad88340858e105e30b9b95699d1
SHA512 5cbdfcbb7e5bf6acb7f8bc245fed032a7914d68760b55f359d35a4b5fbfcb350a0a6989c0f7f6f815c2c658d79e821f38f25f5d2b620d643a94a49fc984849d1
SSDEEP 12288:GCak3wugOJ63b6colgOcIdA6cyhnUF3Z4mxxnsqWmXAnMECUQIZ1D6BF:Fa9ugOUr6TKsWSUQmXsPyAnMECT4gF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4228-46-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/4228-45-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/4228-33-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/4284-10-0x00000000023F0000-0x00000000023F1000-memory.dmp

Download

memory/4284-6-0x00000000023D0000-0x00000000023D1000-memory.dmp

Download

memory/4284-21-0x00000000006F0000-0x00000000006F1000-memory.dmp

Download

memory/4284-20-0x0000000003520000-0x0000000003521000-memory.dmp

Download

memory/4284-17-0x00000000035D0000-0x00000000035D1000-memory.dmp

Download

memory/4284-16-0x00000000035D0000-0x00000000035D1000-memory.dmp

Download

memory/4284-15-0x00000000034D0000-0x00000000034D3000-memory.dmp

Download

memory/4284-14-0x00000000034E0000-0x00000000034E1000-memory.dmp

Download

memory/4284-13-0x00000000034E0000-0x00000000034E1000-memory.dmp

Download

memory/4284-12-0x00000000034E0000-0x00000000034E1000-memory.dmp

Download

memory/4284-11-0x00000000034D0000-0x00000000035D0000-memory.dmp

Download

memory/4284-0-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/4284-9-0x0000000002580000-0x0000000002581000-memory.dmp

Download

memory/4284-8-0x0000000002550000-0x0000000002551000-memory.dmp

Download

memory/4284-7-0x0000000002560000-0x0000000002561000-memory.dmp

Download

memory/4284-22-0x00000000034F0000-0x00000000034F1000-memory.dmp

Download

memory/4284-5-0x00000000023E0000-0x00000000023E1000-memory.dmp

Download

memory/4284-4-0x0000000002570000-0x0000000002571000-memory.dmp

Download

memory/4284-2-0x0000000002430000-0x0000000002431000-memory.dmp

Download

memory/4284-3-0x0000000002400000-0x0000000002401000-memory.dmp

Download

memory/4284-23-0x00000000035D0000-0x00000000035D1000-memory.dmp

Download

memory/4284-32-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/4284-24-0x0000000000700000-0x0000000000701000-memory.dmp

Download

memory/4284-35-0x0000000002340000-0x0000000002394000-memory.dmp

Download

memory/4284-36-0x00000000034D0000-0x00000000035D0000-memory.dmp

Download

memory/4284-42-0x0000000000400000-0x0000000000523000-memory.dmp

Download

memory/4284-43-0x0000000002340000-0x0000000002394000-memory.dmp

Download

memory/4284-18-0x00000000035D0000-0x00000000035D1000-memory.dmp

Download

memory/4284-19-0x00000000035D0000-0x00000000035D1000-memory.dmp

Download

memory/4284-1-0x0000000002340000-0x0000000002394000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads