modiloader | 7b696880e2bbe69c9228cca321996900ddc8893d8928cf6c471e08398edb1ce0

Analysis

max time kernel
144s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 07:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
072176c9cc14a2302186d84f146a2014_JaffaCakes118.exe
Size 1022KB
Sample240624-h3c6mstdmm
SHA256 7b696880e2bbe69c9228cca321996900ddc8893d8928cf6c471e08398edb1ce0
MD5 072176c9cc14a2302186d84f146a2014
SHA1 98878b77c4634b2d8efff4333879c4602dfb9ded
SHA512 a19912ab0afe2df0bb6a3d7b08652583c51e0a7658372921ad536b15a0fb938ebd13b8cb1bd445ac5b5d3feb078169e2e94b37dd0118dd43cb814ccc60b61752
SSDEEP 24576:/c//////jTkDIvUehwwaHPUwEYxXbZb4BQPGt33n8nSzTuozJIH7B:/c//////jTkDkPhwwaHRNxXbZLFS/uos
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 7 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023275-6.dat	modiloader_stage2
behavioral2/memory/640-19-0x0000000000400000-0x00000000004BE000-memory.dmp	modiloader_stage2
behavioral2/memory/1580-20-0x0000000000400000-0x00000000004BE000-memory.dmp	modiloader_stage2
behavioral2/memory/1580-23-0x0000000000400000-0x00000000004BE000-memory.dmp	modiloader_stage2
behavioral2/memory/1580-27-0x0000000000400000-0x00000000004BE000-memory.dmp	modiloader_stage2
behavioral2/memory/1580-29-0x0000000000400000-0x00000000004BE000-memory.dmp	modiloader_stage2
behavioral2/memory/1580-33-0x0000000000400000-0x00000000004BE000-memory.dmp	modiloader_stage2

Executes dropped EXE 3 IoCs

pid	Process
2760	wpe pro.exe
640	Sx_server.exe
1580	xishwbb.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\xishwbb.exe	Sx_server.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\xishwbb.exe	Sx_server.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 736	2468	072176c9cc14a2302186d84f146a2014_JaffaCakes118.exe	91
PID 2468 wrote to memory of 736	2468	072176c9cc14a2302186d84f146a2014_JaffaCakes118.exe	91
PID 2468 wrote to memory of 736	2468	072176c9cc14a2302186d84f146a2014_JaffaCakes118.exe	91
PID 2468 wrote to memory of 4660	2468	072176c9cc14a2302186d84f146a2014_JaffaCakes118.exe	93
PID 2468 wrote to memory of 4660	2468	072176c9cc14a2302186d84f146a2014_JaffaCakes118.exe	93
PID 2468 wrote to memory of 4660	2468	072176c9cc14a2302186d84f146a2014_JaffaCakes118.exe	93
PID 736 wrote to memory of 2760	736	cmd.exe	96
PID 736 wrote to memory of 2760	736	cmd.exe	96
PID 736 wrote to memory of 2760	736	cmd.exe	96
PID 4660 wrote to memory of 640	4660	cmd.exe	95
PID 4660 wrote to memory of 640	4660	cmd.exe	95
PID 4660 wrote to memory of 640	4660	cmd.exe	95
PID 640 wrote to memory of 1580	640	Sx_server.exe	97
PID 640 wrote to memory of 1580	640	Sx_server.exe	97
PID 640 wrote to memory of 1580	640	Sx_server.exe	97
PID 640 wrote to memory of 3616	640	Sx_server.exe	98
PID 640 wrote to memory of 3616	640	Sx_server.exe	98
PID 640 wrote to memory of 3616	640	Sx_server.exe	98

C:\Users\Admin\AppData\Local\Temp\072176c9cc14a2302186d84f146a2014_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\072176c9cc14a2302186d84f146a2014_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\wpe pro.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:736
- - C:\Users\Admin\AppData\Local\Temp\wpe pro.exe
    "C:\Users\Admin\AppData\Local\Temp\wpe pro.exe"
    3⤵
    - Executes dropped EXE
    PID:2760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\Sx_server.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Users\Admin\AppData\Local\Temp\Sx_server.exe
    C:\Users\Admin\AppData\Local\Temp\Sx_server.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:640
  - - C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\xishwbb.exe
      C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\xishwbb.exe
      4⤵
      Executes dropped EXE
      PID:1580
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c erase /F C:\Users\Admin\AppData\Local\Temp\Sx_server.exe
      4⤵
      PID:3616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:4488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Sx_server.exe

Path C:\Users\Admin\AppData\Local\Temp\Sx_server.exe
Size 678KB
SHA256 419bb15c54f1401146e34174c91ce3a32996e9be43e24b9b53a158fac5cca443
MD5 1380d57b8358ebcd9500843a840e7204
SHA1 d1f5a3b9102f1be52ac02cc2771e1ee9675cf1b1
SHA512 84bfe70e1c69c41a68af677bd9ce4aebf7e97eb30ef12cfa0ab00e41020dcd9dc11fb02e5085e9bd182710eabc7afcd755e871b30d4286b7ca83893bf88b0988
SSDEEP 12288:UcWJRg418UGcjdafMUIbEeOQfA3lQFjlePcL0CA5bvT5/M:ILg5UGcBaEU60304jRlvTJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

wpe pro.exe

Path C:\Users\Admin\AppData\Local\Temp\wpe pro.exe
Size 283KB
SHA256 510566ba1cdb147f13ffec477711ec6a7eb7d090a1d176afb89a9bcded3d8267
MD5 c6a68a72deb972657fa20aaa06916e6a
SHA1 ef14098af952c05c0465667f4cc9f73d59331bf4
SHA512 77eafe6ffee768a8d5cc5d3a6ebb67b369499d4718ccb209ad38ef2b5b585536b473d70e500c1e4146d31bece5d9a6dbcdd54dcdb9ce2bab8a2d8e84e680565f
SSDEEP 6144:nVXfDBnlin7stwQW1p/QJO9+/TE/BLryZe0FfH65GXWqj:nVXfRlin7CW1pMkryrtiAj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/640-11-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/640-19-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/1580-20-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/1580-18-0x0000000002230000-0x0000000002231000-memory.dmp

Download

memory/1580-22-0x0000000002230000-0x0000000002231000-memory.dmp

Download

memory/1580-23-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/1580-27-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/1580-29-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/1580-33-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/2468-2-0x0000000000400000-0x0000000000506000-memory.dmp

Download

memory/2760-10-0x00000000001C0000-0x00000000001C2000-memory.dmp

Download

memory/2760-14-0x0000000000400000-0x00000000004F0000-memory.dmp

Download

memory/2760-7-0x0000000000400000-0x00000000004F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads