modiloader | e89a02b1742f58e50369e103f19f030dc1d31aff33f97dda2f35ef1a938cb7d5

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
19d58529bd859c53f9520a9e2ed3a524_JaffaCakes118.exe
Size 380KB
Sample240628-mt2j4avfrc
SHA256 e89a02b1742f58e50369e103f19f030dc1d31aff33f97dda2f35ef1a938cb7d5
MD5 19d58529bd859c53f9520a9e2ed3a524
SHA1 542ded1a740d41bc9df36df64703767008d87ab2
SHA512 bbfa761b443f1243b21f479af77604d9809448636eccc83dc7f273f934ebe7b0d27164c15fb5b9064eeb26084acf4112e84056e14bfc3270578005db5afe3849
SSDEEP 6144:S5emnohbdsdVnyAICBQP7C/aq1HgdxFFzFv9P9TqucPkzd2+9YwA2pIlt0uy0P:HmnQ2znHIC6P7C/pCd9BlPoF6vhYK8P
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/2116-16-0x0000000000400000-0x00000000004BF000-memory.dmp	modiloader_stage2
behavioral2/memory/468-18-0x0000000000400000-0x00000000004BF000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
468	taskmger.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_taskmger.exe	taskmger.exe
File opened for modification	C:\Windows\SysWOW64\_taskmger.exe	taskmger.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 468 set thread context of 4592	468	taskmger.exe	82

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\taskmger.exe	19d58529bd859c53f9520a9e2ed3a524_JaffaCakes118.exe
File opened for modification	C:\Windows\taskmger.exe	19d58529bd859c53f9520a9e2ed3a524_JaffaCakes118.exe
File created	C:\Windows\SxDel.bat	19d58529bd859c53f9520a9e2ed3a524_JaffaCakes118.exe

Program crash 2 IoCs

pid	pid_target	Process
4012	468	WerFault.exe
2416	4592	WerFault.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 468	2116	19d58529bd859c53f9520a9e2ed3a524_JaffaCakes118.exe	81
PID 2116 wrote to memory of 468	2116	19d58529bd859c53f9520a9e2ed3a524_JaffaCakes118.exe	81
PID 2116 wrote to memory of 468	2116	19d58529bd859c53f9520a9e2ed3a524_JaffaCakes118.exe	81
PID 468 wrote to memory of 4592	468	taskmger.exe	82
PID 468 wrote to memory of 4592	468	taskmger.exe	82
PID 468 wrote to memory of 4592	468	taskmger.exe	82
PID 468 wrote to memory of 4592	468	taskmger.exe	82
PID 468 wrote to memory of 4592	468	taskmger.exe	82
PID 468 wrote to memory of 4260	468	taskmger.exe	84
PID 468 wrote to memory of 4260	468	taskmger.exe	84
PID 2116 wrote to memory of 208	2116	19d58529bd859c53f9520a9e2ed3a524_JaffaCakes118.exe	89
PID 2116 wrote to memory of 208	2116	19d58529bd859c53f9520a9e2ed3a524_JaffaCakes118.exe	89
PID 2116 wrote to memory of 208	2116	19d58529bd859c53f9520a9e2ed3a524_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\19d58529bd859c53f9520a9e2ed3a524_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\19d58529bd859c53f9520a9e2ed3a524_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\taskmger.exe
  C:\Windows\taskmger.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\system32\notepad.exe"
    3⤵
    PID:4592
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 12
      4⤵
      Program crash
      PID:2416
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    PID:4260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 656
    3⤵
    - Program crash
    PID:4012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\SxDel.bat
  2⤵
  PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4592 -ip 4592
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 468 -ip 468
1⤵
PID:732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

SxDel.bat

Path C:\Windows\SxDel.bat
Size 212B
SHA256 e0f1c51db66cdc873201d0fa14df2da87bc1ff65e04fd6fc1ae50499b6265095
MD5 02dae0fbbc649edcc12d1bdf5a49bf34
SHA1 06b23264ba12e1f8fcc0a9bb89ce0022d9988c74
SHA512 58f806e4195244aef0657a71e4de2fd10191b98b5ced98447c7a1a87f55393e5b2ce88dd6f2ad2ccc9ff8e23f1b40760ee61e5efe6b49c5d2db845820b6c9bdf
MD5 SHA1 SHA512

Submit Download

_taskmger.exe

Path C:\Windows\SysWOW64\_taskmger.exe
Size 380KB
SHA256 e89a02b1742f58e50369e103f19f030dc1d31aff33f97dda2f35ef1a938cb7d5
MD5 19d58529bd859c53f9520a9e2ed3a524
SHA1 542ded1a740d41bc9df36df64703767008d87ab2
SHA512 bbfa761b443f1243b21f479af77604d9809448636eccc83dc7f273f934ebe7b0d27164c15fb5b9064eeb26084acf4112e84056e14bfc3270578005db5afe3849
SSDEEP 6144:S5emnohbdsdVnyAICBQP7C/aq1HgdxFFzFv9P9TqucPkzd2+9YwA2pIlt0uy0P:HmnQ2znHIC6P7C/pCd9BlPoF6vhYK8P
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/468-7-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/468-10-0x0000000002130000-0x0000000002131000-memory.dmp

Download

memory/468-18-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/2116-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/2116-1-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/2116-16-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/4592-11-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads