modiloader | e39266dfd2a6695471e4494e3e978152dfed0d7e5f049b72120f1ee4338eb82e

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 12:14

Target

15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe
Size

152KB
MD5

15f788bbcfa70c665bfa8853866a8e42
SHA1

a8ddf16580b00f7dffbc32e34c325d1344cb9d10
SHA256

e39266dfd2a6695471e4494e3e978152dfed0d7e5f049b72120f1ee4338eb82e
SHA512

a900de6c91d9426d038156a522f3f95815b382a827be61046a96804e9df3ec8ad9b7caaa44f8b22b3e300f7c109dfa5aa163d564d72143cc5a4765a3a0708360
SSDEEP

3072:wSzrlwFOM7qXzfr665oV4hImPx7IgBHUrbNb:w8rOFO/Df7oY9JsgB0rbR

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/3992-5-0x0000000020000000-0x0000000020026000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3992 set thread context of 1224	3992	15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe	80

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 1224	3992	15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe	80
PID 3992 wrote to memory of 1224	3992	15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe	80
PID 3992 wrote to memory of 1224	3992	15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe	80
PID 3992 wrote to memory of 1224	3992	15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe	80
PID 3992 wrote to memory of 1224	3992	15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe	80

C:\Users\Admin\AppData\Local\Temp\15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Users\Admin\AppData\Local\Temp\15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\15f788bbcfa70c665bfa8853866a8e42_JaffaCakes118.exe
  2⤵
  PID:1224

memory/1224-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1224-6-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1224-7-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3992-1-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/3992-3-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/3992-5-0x0000000020000000-0x0000000020026000-memory.dmp

Filesize
152KB

Download
memory/3992-2-0x0000000002010000-0x0000000002011000-memory.dmp

Filesize
4KB

Download