modiloader | c9fac0722c6eaffa1ae6d6941d2d183e457844a2808a0ca7271a8fcef08b124f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 01:49

Target

243869d14e5a9411b5ce0086602ea195_JaffaCakes118.exe
Size

17KB
MD5

243869d14e5a9411b5ce0086602ea195
SHA1

383eb42b5e3717ddd6092ca03959385705ea2839
SHA256

c9fac0722c6eaffa1ae6d6941d2d183e457844a2808a0ca7271a8fcef08b124f
SHA512

4edecedc2908f3f390db864647158d6f6ae283542f5832d34124913ff71a45b00aab3b100e65d18f42936b1017b7b1bc3cdf5c46bbad194cba68f76ee2faaeac
SSDEEP

384:u/cWKiBB1uvOVTgQ8AqgBh4iViIk5ihtl04ndMziF+sq8:QQiB/7gQ8AqgBCiZffCioI

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral2/memory/4596-0-0x0000000000400000-0x000000000040A000-memory.dmp	modiloader_stage2
behavioral2/memory/4596-2-0x0000000000400000-0x000000000040A000-memory.dmp	modiloader_stage2
behavioral2/memory/4596-1-0x0000000000400000-0x000000000040A000-memory.dmp	modiloader_stage2
behavioral2/memory/4596-3-0x0000000000400000-0x000000000040A000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4988 set thread context of 4596	4988	243869d14e5a9411b5ce0086602ea195_JaffaCakes118.exe	83

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 4596	4988	243869d14e5a9411b5ce0086602ea195_JaffaCakes118.exe	83
PID 4988 wrote to memory of 4596	4988	243869d14e5a9411b5ce0086602ea195_JaffaCakes118.exe	83
PID 4988 wrote to memory of 4596	4988	243869d14e5a9411b5ce0086602ea195_JaffaCakes118.exe	83
PID 4988 wrote to memory of 4596	4988	243869d14e5a9411b5ce0086602ea195_JaffaCakes118.exe	83
PID 4988 wrote to memory of 4596	4988	243869d14e5a9411b5ce0086602ea195_JaffaCakes118.exe	83
PID 4988 wrote to memory of 4596	4988	243869d14e5a9411b5ce0086602ea195_JaffaCakes118.exe	83
PID 4988 wrote to memory of 4596	4988	243869d14e5a9411b5ce0086602ea195_JaffaCakes118.exe	83
PID 4988 wrote to memory of 4596	4988	243869d14e5a9411b5ce0086602ea195_JaffaCakes118.exe	83
PID 4988 wrote to memory of 4596	4988	243869d14e5a9411b5ce0086602ea195_JaffaCakes118.exe	83
PID 4988 wrote to memory of 4596	4988	243869d14e5a9411b5ce0086602ea195_JaffaCakes118.exe	83
PID 4988 wrote to memory of 4596	4988	243869d14e5a9411b5ce0086602ea195_JaffaCakes118.exe	83
PID 4988 wrote to memory of 4596	4988	243869d14e5a9411b5ce0086602ea195_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\243869d14e5a9411b5ce0086602ea195_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\243869d14e5a9411b5ce0086602ea195_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Users\Admin\AppData\Local\Temp\243869d14e5a9411b5ce0086602ea195_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\243869d14e5a9411b5ce0086602ea195_JaffaCakes118.exe
  2⤵
  PID:4596

memory/4596-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4596-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4596-1-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4596-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download