modiloader | 90508d08579c41f03b12e84c670ce894411514be9eb06324c774c3c9c07de193

Analysis

max time kernel
126s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 13:46

Target
22904cb83a26ee0192d86e0872e41e41_JaffaCakes118.exe
Size 699KB
Sample240703-q27ymazdnd
SHA256 90508d08579c41f03b12e84c670ce894411514be9eb06324c774c3c9c07de193
MD5 22904cb83a26ee0192d86e0872e41e41
SHA1 59666d6e233ce8e297172507384d113d439ac8b2
SHA512 384b6397f6fca3387af03df95daff63eff0c8c1d7dfe65c1258f21259d4c606610572e3f35217e3ced4d1d8b0072deaca8655b4c7787223f14627556dc56e5c0
SSDEEP 12288:IjViuLub5jHX97DbT8UGOW7P2LdAWSCWm1zN+TzTLrZ:U/LIjHXpD8vhP2ZPtzN+TzjZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/3180-2-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt	22904cb83a26ee0192d86e0872e41e41_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 2144	3180	22904cb83a26ee0192d86e0872e41e41_JaffaCakes118.exe	89
PID 3180 wrote to memory of 2144	3180	22904cb83a26ee0192d86e0872e41e41_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\22904cb83a26ee0192d86e0872e41e41_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\22904cb83a26ee0192d86e0872e41e41_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3180
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=996,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:8
1⤵
PID:4836

memory/3180-1-0x0000000002130000-0x0000000002131000-memory.dmp

Download

memory/3180-2-0x0000000000400000-0x00000000004C0000-memory.dmp

Download