modiloader | e39266dfd2a6695471e4494e3e978152dfed0d7e5f049b72120f1ee4338eb82e

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 12:14

Target

15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe
Size

152KB
MD5

15f788bbcfa70c665bfa8853866a8e42
SHA1

a8ddf16580b00f7dffbc32e34c325d1344cb9d10
SHA256

e39266dfd2a6695471e4494e3e978152dfed0d7e5f049b72120f1ee4338eb82e
SHA512

a900de6c91d9426d038156a522f3f95815b382a827be61046a96804e9df3ec8ad9b7caaa44f8b22b3e300f7c109dfa5aa163d564d72143cc5a4765a3a0708360
SSDEEP

3072:wSzrlwFOM7qXzfr665oV4hImPx7IgBHUrbNb:w8rOFO/Df7oY9JsgB0rbR

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2240-12-0x0000000020000000-0x0000000020026000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2240 set thread context of 2592	2240	15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe	28

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2592	2240	15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2592	2240	15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2592	2240	15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2592	2240	15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2592	2240	15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe	28
PID 2240 wrote to memory of 2592	2240	15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe
  2⤵
  PID:2592

memory/2240-12-0x0000000020000000-0x0000000020026000-memory.dmp

Filesize
152KB

Download
memory/2240-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2592-15-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2592-14-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2592-11-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2592-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2592-8-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download