modiloader | d7b80a958967c772e33f99a8a64e24ce3f0796d14f796aff6f3ffea9cbd1f89a

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 09:01

Target

1569e677322d3b7eee49d577818b0032_JaffaCakes118.exe
Size

731KB
MD5

1569e677322d3b7eee49d577818b0032
SHA1

3c2712b9e3978c42089681dc20fda384dad3da71
SHA256

d7b80a958967c772e33f99a8a64e24ce3f0796d14f796aff6f3ffea9cbd1f89a
SHA512

9f820851454aa22c096f1348a06338380daf51823a846a49eb1df7c066ff30da4940c75ad4e8df0a8538b5a32c47d5b4c8995e694ba033f6201808c617cd28d2
SSDEEP

12288:JERVq31AQHW3W4KlqckjwfIVLU37f2wx/hCzJji6KTZ6V33TMHZV:y3qeG4KUchcu2PRm613TM5V

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral2/memory/1968-0-0x0000000000400000-0x00000000004CB000-memory.dmp	modiloader_stage2
behavioral2/memory/1968-3-0x0000000000400000-0x00000000004CB000-memory.dmp	modiloader_stage2
behavioral2/memory/4208-4-0x0000000000400000-0x00000000004CB000-memory.dmp	modiloader_stage2
behavioral2/memory/1968-5-0x0000000000400000-0x00000000004CB000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1968 set thread context of 4208	1968	1569e677322d3b7eee49d577818b0032_JaffaCakes118.exe	81

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\2010.txt	1569e677322d3b7eee49d577818b0032_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1552	4208	WerFault.exe	81

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4208	mstsc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 4208	1968	1569e677322d3b7eee49d577818b0032_JaffaCakes118.exe	81
PID 1968 wrote to memory of 4208	1968	1569e677322d3b7eee49d577818b0032_JaffaCakes118.exe	81
PID 1968 wrote to memory of 4208	1968	1569e677322d3b7eee49d577818b0032_JaffaCakes118.exe	81
PID 1968 wrote to memory of 4208	1968	1569e677322d3b7eee49d577818b0032_JaffaCakes118.exe	81
PID 1968 wrote to memory of 4208	1968	1569e677322d3b7eee49d577818b0032_JaffaCakes118.exe	81

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4208 -ip 4208
1⤵
PID:4372

memory/1968-0-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1968-1-0x00000000004C4000-0x00000000004C6000-memory.dmp

Filesize
8KB

Download
memory/1968-3-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/1968-5-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/4208-4-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download