modiloader | 677623b0ad61a2ea5baecc39c7c16f3918759f91420519eb24bafc005981cd93

Analysis

max time kernel
130s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 04:46

Target
14ba362448b91c63716a99eb387bff07_JaffaCakes118.exe
Size 704KB
Sample240627-fd153awamk
SHA256 677623b0ad61a2ea5baecc39c7c16f3918759f91420519eb24bafc005981cd93
MD5 14ba362448b91c63716a99eb387bff07
SHA1 407c08c72dfb4c2351452363b44b5fa953f56b8f
SHA512 d3aada9e2d0983453d5efa13d8299cbb47c55499f5de2da871deee9ea459c6f1d0be703b20ba6a8f87f830bb96e5dc24b99393788e66a861350c243d836eddcf
SSDEEP 12288:QUSZ6lVrCdN8ca4/+edhBnRd4gYCLR9YT9UOsTIXjK:QjwXCDtJ/j9ggLN0UOsTIX2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/1552-0-0x0000000000400000-0x00000000004B7000-memory.dmp	modiloader_stage2

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3884	1552	WerFault.exe	82
1876	1552	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\14ba362448b91c63716a99eb387bff07_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\14ba362448b91c63716a99eb387bff07_JaffaCakes118.exe"
1⤵
PID:1552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 540
  2⤵
  - Program crash
  PID:3884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 736
  2⤵
  - Program crash
  PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1552 -ip 1552
1⤵
PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1552 -ip 1552
1⤵
PID:656

memory/1552-0-0x0000000000400000-0x00000000004B7000-memory.dmp

Download