modiloader | 06cc96e8480e244bf31d5080988a4c5af9530bf31a1e5bde269bd89b196b6c6a

General

Target

2b9fa65bf89fba214f46e9fefd78f7b9_JaffaCakes118.exe
Size

757KB
MD5

2b9fa65bf89fba214f46e9fefd78f7b9
SHA1

6be38488c98bec2f74b708f37523f75f8bf71e8a
SHA256

06cc96e8480e244bf31d5080988a4c5af9530bf31a1e5bde269bd89b196b6c6a
SHA512

7edceb4f33a5f63ec1ab24c3ee948b216f6b8ab6b925e8b57e0be59c9e59bbc1efec9a64083c23c915fe1cb47ae1ce4f10c8bb513e7771b893a63bbe4b848c9a
SSDEEP

12288:URdHFZSwdO2oosWfVyLa0iMHN3/m2xtEYba85bv/KdsF3Z4mxxPFkGQ5Angp4rMp:URdfE2o4fILaYHxZX/6CQmX9kGcUxoHJ

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2768-25-0x0000000000400000-0x000000000050D000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt	2b9fa65bf89fba214f46e9fefd78f7b9_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2836	2768	WerFault.exe	30

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2800	2768	2b9fa65bf89fba214f46e9fefd78f7b9_JaffaCakes118.exe	31
PID 2768 wrote to memory of 2800	2768	2b9fa65bf89fba214f46e9fefd78f7b9_JaffaCakes118.exe	31
PID 2768 wrote to memory of 2800	2768	2b9fa65bf89fba214f46e9fefd78f7b9_JaffaCakes118.exe	31
PID 2768 wrote to memory of 2800	2768	2b9fa65bf89fba214f46e9fefd78f7b9_JaffaCakes118.exe	31
PID 2768 wrote to memory of 2836	2768	2b9fa65bf89fba214f46e9fefd78f7b9_JaffaCakes118.exe	32
PID 2768 wrote to memory of 2836	2768	2b9fa65bf89fba214f46e9fefd78f7b9_JaffaCakes118.exe	32
PID 2768 wrote to memory of 2836	2768	2b9fa65bf89fba214f46e9fefd78f7b9_JaffaCakes118.exe	32
PID 2768 wrote to memory of 2836	2768	2b9fa65bf89fba214f46e9fefd78f7b9_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\2b9fa65bf89fba214f46e9fefd78f7b9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2b9fa65bf89fba214f46e9fefd78f7b9_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2768
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:2800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 312
  2⤵
  - Program crash
  PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2768-0-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2768-9-0x00000000020D0000-0x00000000020D1000-memory.dmp

Filesize
4KB

Download
memory/2768-8-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/2768-7-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/2768-6-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/2768-5-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/2768-4-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/2768-3-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/2768-2-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/2768-1-0x00000000002C0000-0x0000000000314000-memory.dmp

Filesize
336KB

Download
memory/2768-10-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download
memory/2768-11-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download
memory/2768-13-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download
memory/2768-14-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download
memory/2768-16-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download
memory/2768-15-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download
memory/2768-18-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download
memory/2768-17-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download
memory/2768-19-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download
memory/2768-20-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download
memory/2768-24-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/2768-23-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download
memory/2768-22-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download
memory/2768-21-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download
memory/2768-25-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2768-26-0x00000000002C0000-0x0000000000314000-memory.dmp

Filesize
336KB

Download
memory/2768-28-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download
memory/2768-29-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download
memory/2768-30-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download
memory/2768-32-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download
memory/2768-31-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads