modiloader | 924f81d4966df2d73fc91fb6d302e2691bb6154d8ed85edd55a05aae965044bb

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 11:44

Target

349427248f8741c1280e167c9e1268f3_JaffaCakes118.exe
Size

151KB
MD5

349427248f8741c1280e167c9e1268f3
SHA1

7a125b6e131a957a1a8304c999f94b86c75f77da
SHA256

924f81d4966df2d73fc91fb6d302e2691bb6154d8ed85edd55a05aae965044bb
SHA512

85e72248dd753e97834c8fcfb9b2269222d1fa61423ad81ff77f61833b66732079a555c0bce7951af621f9714c19f92f0029fc76e4d962048e341b07abd4abbf
SSDEEP

3072:OFgAhlTmDv4WcCA9eEv3DsC6t8ffESVi08e6:uXhZ4z6L/oI2f

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/memory/2528-0-0x0000000000400000-0x0000000000426A00-memory.dmp	modiloader_stage2
behavioral1/memory/2528-2-0x0000000000400000-0x0000000000426A00-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

pid	Process
1868	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2528-0-0x0000000000400000-0x0000000000426A00-memory.dmp	upx
behavioral1/memory/2528-2-0x0000000000400000-0x0000000000426A00-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\wyls.exe	349427248f8741c1280e167c9e1268f3_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\wyls.exe	349427248f8741c1280e167c9e1268f3_JaffaCakes118.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7F4D1081-25FD-44F5-99C6-FF271CFB7EC2}	349427248f8741c1280e167c9e1268f3_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7F4D1081-25FD-44F5-99C6-FF271CFB7EC2}\	349427248f8741c1280e167c9e1268f3_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7F4D1081-25FD-44F5-99C6-FF271CFB7EC2}\InProcServer32	349427248f8741c1280e167c9e1268f3_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7F4D1081-25FD-44F5-99C6-FF271CFB7EC2}\InProcServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\MSINFO\\SysInfo1.dll"	349427248f8741c1280e167c9e1268f3_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7F4D1081-25FD-44F5-99C6-FF271CFB7EC2}\InProcServer32\ThreadingModel = "Apartment"	349427248f8741c1280e167c9e1268f3_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1868	2528	349427248f8741c1280e167c9e1268f3_JaffaCakes118.exe	30
PID 2528 wrote to memory of 1868	2528	349427248f8741c1280e167c9e1268f3_JaffaCakes118.exe	30
PID 2528 wrote to memory of 1868	2528	349427248f8741c1280e167c9e1268f3_JaffaCakes118.exe	30
PID 2528 wrote to memory of 1868	2528	349427248f8741c1280e167c9e1268f3_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\349427248f8741c1280e167c9e1268f3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\349427248f8741c1280e167c9e1268f3_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\349427248f8741c1280e167c9e1268f3_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  PID:1868

memory/2528-0-0x0000000000400000-0x0000000000426A00-memory.dmp

Filesize
154KB

Download
memory/2528-2-0x0000000000400000-0x0000000000426A00-memory.dmp

Filesize
154KB

Download