modiloader | 52fd6afc92ce2df190376cd7b0e3a5bdfd27f53b4d16b0b52f62d2c9a98a79c1

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21590b47c771984615878e009f2771ae_JaffaCakes118.exe
Size

722KB
MD5

21590b47c771984615878e009f2771ae
SHA1

0ed66364efc4298bf6aa3750bc7db58e7a04dd30
SHA256

52fd6afc92ce2df190376cd7b0e3a5bdfd27f53b4d16b0b52f62d2c9a98a79c1
SHA512

088f3d87ef5136dfcedd808a3bf3a14e51ebead443c798202441e4bb888782fb60f0a231e96f7910b2fd8489e03d5ede2af9e2ccd199c5d479fd8a6ac7cb81fb
SSDEEP

12288:fn1baIwTEgRgJxEYO+lzKB86I6S1KAQUNZcAWeDNfXE6WhqAT7z:v1bNL+IxbO+lGIZrTNZcABWd5TX

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/1984-59-0x0000000000400000-0x0000000000517000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt	21590b47c771984615878e009f2771ae_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2720	1984	21590b47c771984615878e009f2771ae_JaffaCakes118.exe	29
PID 1984 wrote to memory of 2720	1984	21590b47c771984615878e009f2771ae_JaffaCakes118.exe	29
PID 1984 wrote to memory of 2720	1984	21590b47c771984615878e009f2771ae_JaffaCakes118.exe	29
PID 1984 wrote to memory of 2720	1984	21590b47c771984615878e009f2771ae_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\21590b47c771984615878e009f2771ae_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\21590b47c771984615878e009f2771ae_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1984
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-0-0x00000000002D0000-0x0000000000324000-memory.dmp

Filesize
336KB

Download
memory/1984-12-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/1984-25-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/1984-24-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-23-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-22-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/1984-21-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/1984-20-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/1984-19-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/1984-18-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/1984-17-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-16-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/1984-15-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/1984-14-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/1984-13-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/1984-11-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/1984-10-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/1984-9-0x00000000020B0000-0x00000000020B1000-memory.dmp

Filesize
4KB

Download
memory/1984-8-0x0000000002120000-0x0000000002121000-memory.dmp

Filesize
4KB

Download
memory/1984-7-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/1984-6-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1984-5-0x0000000001F70000-0x0000000001F71000-memory.dmp

Filesize
4KB

Download
memory/1984-4-0x0000000001F80000-0x0000000001F81000-memory.dmp

Filesize
4KB

Download
memory/1984-3-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/1984-2-0x00000000020C0000-0x00000000020C1000-memory.dmp

Filesize
4KB

Download
memory/1984-1-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/1984-43-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-53-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/1984-56-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/1984-58-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/1984-62-0x00000000002D0000-0x0000000000324000-memory.dmp

Filesize
336KB

Download
memory/1984-61-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-60-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/1984-59-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/1984-55-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/1984-54-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/1984-50-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/1984-49-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-48-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-47-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-46-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-45-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-44-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-42-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-41-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-40-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-39-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-38-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-37-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-36-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-35-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-34-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-33-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-32-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-31-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-30-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-29-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-28-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-27-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/1984-26-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download