modiloader | 90508d08579c41f03b12e84c670ce894411514be9eb06324c774c3c9c07de193

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 13:46

Target
22904cb83a26ee0192d86e0872e41e41_JaffaCakes118.exe
Size 699KB
Sample240703-q27ymazdnd
SHA256 90508d08579c41f03b12e84c670ce894411514be9eb06324c774c3c9c07de193
MD5 22904cb83a26ee0192d86e0872e41e41
SHA1 59666d6e233ce8e297172507384d113d439ac8b2
SHA512 384b6397f6fca3387af03df95daff63eff0c8c1d7dfe65c1258f21259d4c606610572e3f35217e3ced4d1d8b0072deaca8655b4c7787223f14627556dc56e5c0
SSDEEP 12288:IjViuLub5jHX97DbT8UGOW7P2LdAWSCWm1zN+TzTLrZ:U/LIjHXpD8vhP2ZPtzN+TzjZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2060-2-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt	22904cb83a26ee0192d86e0872e41e41_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2100	2060	22904cb83a26ee0192d86e0872e41e41_JaffaCakes118.exe	28
PID 2060 wrote to memory of 2100	2060	22904cb83a26ee0192d86e0872e41e41_JaffaCakes118.exe	28
PID 2060 wrote to memory of 2100	2060	22904cb83a26ee0192d86e0872e41e41_JaffaCakes118.exe	28
PID 2060 wrote to memory of 2100	2060	22904cb83a26ee0192d86e0872e41e41_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\22904cb83a26ee0192d86e0872e41e41_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\22904cb83a26ee0192d86e0872e41e41_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2060
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:2100

memory/2060-0-0x0000000000260000-0x0000000000261000-memory.dmp

Download

memory/2060-2-0x0000000000400000-0x00000000004C0000-memory.dmp

Download