modiloader | 80eb853f4d442860b21adf58bc657864ff9bcd43257efa516e9494a6e970794b

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 11:34

Target
19f61340c83ee85d3c49069f8ff5d860_JaffaCakes118.exe
Size 1.2MB
Sample240628-npjn6azelq
SHA256 80eb853f4d442860b21adf58bc657864ff9bcd43257efa516e9494a6e970794b
MD5 19f61340c83ee85d3c49069f8ff5d860
SHA1 086793706b2b4914bf4cbc6b67a2c8322dd302aa
SHA512 0c7f90224065a9bc1022be786a834a557f24c4c50087e0dd676b4b0a8c56acc4afd26ab39caac8a5d7e58140add39650ec453e9b079cbcd3cb114d9adab57495
SSDEEP 24576:ELg5UGcBaEU60324jRlvTBeQREP5RL+Slixrmc+kwUMG3ZuGs:E3/GHTBenLEqfzFADs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/1624-2-0x0000000000400000-0x00000000004BE000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~1\2010.txt	19f61340c83ee85d3c49069f8ff5d860_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 736	1624	19f61340c83ee85d3c49069f8ff5d860_JaffaCakes118.exe	80
PID 1624 wrote to memory of 736	1624	19f61340c83ee85d3c49069f8ff5d860_JaffaCakes118.exe	80

C:\Users\Admin\AppData\Local\Temp\19f61340c83ee85d3c49069f8ff5d860_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\19f61340c83ee85d3c49069f8ff5d860_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1624
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:736

memory/1624-1-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/1624-2-0x0000000000400000-0x00000000004BE000-memory.dmp

Download