modiloader | 7281a1b3dacf8f2d53c53e68d41e6abfafffa5d5788707396be484145547cce1

Analysis

max time kernel
134s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20feff218c520489b0efc3f0d52d2379_JaffaCakes118.exe
Size 648KB
Sample240703-ehleqswepe
SHA256 7281a1b3dacf8f2d53c53e68d41e6abfafffa5d5788707396be484145547cce1
MD5 20feff218c520489b0efc3f0d52d2379
SHA1 c838ff360898598e66e007a9b5644a36a0c2c764
SHA512 95eb31578cbed63f37c7ef4747c65e7865d29c73aea3d406b345927ebfd7983c95f05b081f8b106be8c5a54f64700daa9d4846f26e99cb21d1872765b394a694
SSDEEP 12288:cB4H3U2ZyaLz0b+kJ9KV2RjlYKa7VF3Z4mxxC2imXqm9uQpMyOzrz:FH3UIyozI9KMj7YQmXCJmqm9Sy2rz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/1384-34-0x0000000000400000-0x0000000000518000-memory.dmp	modiloader_stage2
behavioral2/memory/1764-39-0x0000000000400000-0x0000000000518000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

pid	Process
1764	servicer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_servicer.exe	servicer.exe
File opened for modification	C:\Windows\SysWOW64\_servicer.exe	servicer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1764 set thread context of 4704	1764	servicer.exe	87

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\servicer.exe	20feff218c520489b0efc3f0d52d2379_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.bat	20feff218c520489b0efc3f0d52d2379_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\servicer.exe	20feff218c520489b0efc3f0d52d2379_JaffaCakes118.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3312	4704	WerFault.exe	87
668	1764	WerFault.exe	86

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1764	1384	20feff218c520489b0efc3f0d52d2379_JaffaCakes118.exe	86
PID 1384 wrote to memory of 1764	1384	20feff218c520489b0efc3f0d52d2379_JaffaCakes118.exe	86
PID 1384 wrote to memory of 1764	1384	20feff218c520489b0efc3f0d52d2379_JaffaCakes118.exe	86
PID 1764 wrote to memory of 4704	1764	servicer.exe	87
PID 1764 wrote to memory of 4704	1764	servicer.exe	87
PID 1764 wrote to memory of 4704	1764	servicer.exe	87
PID 1764 wrote to memory of 4704	1764	servicer.exe	87
PID 1764 wrote to memory of 4704	1764	servicer.exe	87
PID 1764 wrote to memory of 3260	1764	servicer.exe	88
PID 1764 wrote to memory of 3260	1764	servicer.exe	88
PID 1384 wrote to memory of 4204	1384	20feff218c520489b0efc3f0d52d2379_JaffaCakes118.exe	95
PID 1384 wrote to memory of 4204	1384	20feff218c520489b0efc3f0d52d2379_JaffaCakes118.exe	95
PID 1384 wrote to memory of 4204	1384	20feff218c520489b0efc3f0d52d2379_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\20feff218c520489b0efc3f0d52d2379_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\20feff218c520489b0efc3f0d52d2379_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Program Files\Common Files\Microsoft Shared\MSINFO\servicer.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSINFO\servicer.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\system32\calc.exe"
    3⤵
    PID:4704
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 12
      4⤵
      Program crash
      PID:3312
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    PID:3260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 688
    3⤵
    - Program crash
    PID:668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.bat""
  2⤵
  PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4704 -ip 4704
1⤵
PID:4088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1764 -ip 1764
1⤵
PID:3300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

SxingDel.bat

Path C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxingDel.bat
Size 212B
SHA256 4d5ee4a95e2b3612cf6b36dd302745fb8a3f8f9d0bec79ecf02fc18425f1583f
MD5 3dce410296c4caad9fb9871b74e36a12
SHA1 c7aa64a6ff938246d4b26f29f1281c19ec025a0e
SHA512 d21db1202b2dceed0e9008b9500ae9e53e906318153d6e5774b64fff389336bb3d388cc14713f890a54a9997c885b1b4316f267d339e22e5efc6c9a946e136c0
MD5 SHA1 SHA512

Submit Download

servicer.exe

Path C:\Program Files\Common Files\microsoft shared\MSInfo\servicer.exe
Size 648KB
SHA256 7281a1b3dacf8f2d53c53e68d41e6abfafffa5d5788707396be484145547cce1
MD5 20feff218c520489b0efc3f0d52d2379
SHA1 c838ff360898598e66e007a9b5644a36a0c2c764
SHA512 95eb31578cbed63f37c7ef4747c65e7865d29c73aea3d406b345927ebfd7983c95f05b081f8b106be8c5a54f64700daa9d4846f26e99cb21d1872765b394a694
SSDEEP 12288:cB4H3U2ZyaLz0b+kJ9KV2RjlYKa7VF3Z4mxxC2imXqm9uQpMyOzrz:FH3UIyozI9KMj7YQmXCJmqm9Sy2rz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1384-5-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Download

memory/1384-4-0x0000000002410000-0x0000000002411000-memory.dmp

Download

memory/1384-20-0x00000000025A0000-0x00000000025A1000-memory.dmp

Download

memory/1384-19-0x0000000003410000-0x0000000003411000-memory.dmp

Download

memory/1384-18-0x00000000033A0000-0x00000000033A1000-memory.dmp

Download

memory/1384-17-0x00000000033B0000-0x00000000033B1000-memory.dmp

Download

memory/1384-16-0x00000000033C0000-0x00000000033C1000-memory.dmp

Download

memory/1384-15-0x00000000006A0000-0x00000000006A1000-memory.dmp

Download

memory/1384-12-0x0000000003380000-0x0000000003383000-memory.dmp

Download

memory/1384-11-0x0000000003390000-0x0000000003391000-memory.dmp

Download

memory/1384-10-0x00000000023A0000-0x00000000023A1000-memory.dmp

Download

memory/1384-8-0x00000000023E0000-0x00000000023E1000-memory.dmp

Download

memory/1384-7-0x00000000023F0000-0x00000000023F1000-memory.dmp

Download

memory/1384-6-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Download

memory/1384-13-0x0000000003480000-0x0000000003481000-memory.dmp

Download

memory/1384-1-0x0000000000A40000-0x0000000000A94000-memory.dmp

Download

memory/1384-35-0x0000000000A40000-0x0000000000A94000-memory.dmp

Download

memory/1384-3-0x00000000023B0000-0x00000000023B1000-memory.dmp

Download

memory/1384-2-0x00000000023D0000-0x00000000023D1000-memory.dmp

Download

memory/1384-9-0x0000000002420000-0x0000000002421000-memory.dmp

Download

memory/1384-14-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1384-36-0x0000000003400000-0x0000000003401000-memory.dmp

Download

memory/1384-0-0x0000000000400000-0x0000000000518000-memory.dmp

Download

memory/1384-34-0x0000000000400000-0x0000000000518000-memory.dmp

Download

memory/1384-37-0x00000000033F0000-0x00000000033F1000-memory.dmp

Download

memory/1764-27-0x00000000008F0000-0x0000000000944000-memory.dmp

Download

memory/1764-26-0x0000000000400000-0x0000000000518000-memory.dmp

Download

memory/1764-40-0x00000000008F0000-0x0000000000944000-memory.dmp

Download

memory/1764-39-0x0000000000400000-0x0000000000518000-memory.dmp

Download

memory/4704-30-0x0000000000400000-0x0000000000518000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads