modiloader | 9a893dba233861f3687cd850f51f4a3631ee487159855fe92238e6ebb1473b32

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 04:38

Target
21199ee114feb26fbe5a9754ed24d7ef_JaffaCakes118.exe
Size 687KB
Sample240703-e9hg6axgkc
SHA256 9a893dba233861f3687cd850f51f4a3631ee487159855fe92238e6ebb1473b32
MD5 21199ee114feb26fbe5a9754ed24d7ef
SHA1 4a7c4a365a511ce746e90d4c2ec61db553b96734
SHA512 5abd7a2bea5fcb1c008a77e91db36186c37eba6f36677b8dcb1d53f5620e7ce59b3418d1e9a6589f9c7931fed782e5f226a5b0b90484bf18a8ae40c88f6701ee
SSDEEP 12288:dcWJRg418UGcjdafMUIbEeOQfA3lQQjlePcL0CA5bvTGM2wx:tLg5UGcBaEU603f4jRlvTl2wx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/644-2-0x0000000000400000-0x00000000004C0200-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\2010.txt	21199ee114feb26fbe5a9754ed24d7ef_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 1500	644	21199ee114feb26fbe5a9754ed24d7ef_JaffaCakes118.exe	80
PID 644 wrote to memory of 1500	644	21199ee114feb26fbe5a9754ed24d7ef_JaffaCakes118.exe	80

C:\Users\Admin\AppData\Local\Temp\21199ee114feb26fbe5a9754ed24d7ef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\21199ee114feb26fbe5a9754ed24d7ef_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:644
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:1500

memory/644-1-0x00000000007B0000-0x00000000007B1000-memory.dmp

Download

memory/644-2-0x0000000000400000-0x00000000004C0200-memory.dmp

Download