modiloader | b9bdbb2ec4295354c71033d638b8b555cfd4f77f70580826a9a02c5989862d41

Analysis

max time kernel
133s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 23:47

Target
17fffdf52e92d4675a06f602015b286e_JaffaCakes118.exe
Size 54KB
Sample240627-3s93vaygrd
SHA256 b9bdbb2ec4295354c71033d638b8b555cfd4f77f70580826a9a02c5989862d41
MD5 17fffdf52e92d4675a06f602015b286e
SHA1 6d072eacd68829f8fd673ff9e6dc186be0a8c0f1
SHA512 1b116cb8a1184eeea1cc1514a6c46f4ce86ca4dfdcac63ab51fe83c395567d6818fdc15c25978b8dbd5e68d97c2518ee673b002c38b934d5eaafc6269ab05eaf
SSDEEP 768:JJcUTqFQm109y2gKu1NIVQ5Ot364K4i4VQ0+hDLN5Dmp8UdQBOxPY8Hgc0Xes:g8qFQW09kx1LuaN5Dmp8U6oI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral2/memory/652-0-0x0000000000010000-0x0000000000025000-memory.dmp	modiloader_stage2
behavioral2/files/0x0008000000023425-6.dat	modiloader_stage2
behavioral2/memory/652-9-0x0000000000010000-0x0000000000025000-memory.dmp	modiloader_stage2
behavioral2/memory/652-10-0x0000000000680000-0x000000000068B000-memory.dmp	modiloader_stage2

Loads dropped DLL 2 IoCs

pid	Process
652	17fffdf52e92d4675a06f602015b286e_JaffaCakes118.exe
652	17fffdf52e92d4675a06f602015b286e_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4960	652	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\17fffdf52e92d4675a06f602015b286e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17fffdf52e92d4675a06f602015b286e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
PID:652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 372
  2⤵
  - Program crash
  PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 652 -ip 652
1⤵
PID:4564

kacir.dll

Path C:\Users\Admin\AppData\Local\Temp\kacir.dll
Size 19KB
SHA256 e5fa2290f69a152c53dec772142ddb3d4c04cb2ee25ad05b0ec97ab202361f11
MD5 dda37de6068ad16771e3a6464bb8778b
SHA1 903317703bfcd07e9bea7246920de98916017e08
SHA512 1d38ba967b34c6d48b8048bf282484bc6c8d6f3644a127a8102d3edbcf5dd854744da7e8f15b10b93b6124db634a7c891c1c175fca8a7b2e6810fc204132ea05
SSDEEP 384:1RdCy9MqlWTmQ62brtKB4aaJjxo47dm3z092b:9CyaqlGmQJbwB49jxo4Uj0U
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/652-0-0x0000000000010000-0x0000000000025000-memory.dmp

Download

memory/652-9-0x0000000000010000-0x0000000000025000-memory.dmp

Download

memory/652-10-0x0000000000680000-0x000000000068B000-memory.dmp

Download