modiloader | 98b964f4f100474845ca7c7c26b797b8b18099cb0c132f24c1630b59c2eca9e5

Analysis

max time kernel
16s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 18:56

Target

35f8707886f9e420f35d501fc7e23417_JaffaCakes118.exe
Size

312KB
MD5

35f8707886f9e420f35d501fc7e23417
SHA1

608505182ee412a9d353a84c13ca803f547abe1c
SHA256

98b964f4f100474845ca7c7c26b797b8b18099cb0c132f24c1630b59c2eca9e5
SHA512

a2cf7a1f6fe6dccb03bd639e360e41a99643e544c7ad9cea44062082b9e5d234d0d69799403ed600140da13844be376b9d90488a3f7d40093c05b571690431c1
SSDEEP

6144:s70MBf+vpnFWix3avIY2g55B3bFQDZ2TKZqrhyfISTC8H5MaxOcGX5dhduESlHtK:XMBfyH7xqQ3y5B/IqrAISTCe5MaxDGXR

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/1048-7-0x0000000000400000-0x0000000000512000-memory.dmp	modiloader_stage2

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FieleWay.txt	35f8707886f9e420f35d501fc7e23417_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 692	1048	35f8707886f9e420f35d501fc7e23417_JaffaCakes118.exe	29
PID 1048 wrote to memory of 692	1048	35f8707886f9e420f35d501fc7e23417_JaffaCakes118.exe	29
PID 1048 wrote to memory of 692	1048	35f8707886f9e420f35d501fc7e23417_JaffaCakes118.exe	29
PID 1048 wrote to memory of 692	1048	35f8707886f9e420f35d501fc7e23417_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\35f8707886f9e420f35d501fc7e23417_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\35f8707886f9e420f35d501fc7e23417_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1048
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:692

memory/1048-0-0x0000000000400000-0x0000000000512000-memory.dmp

Filesize
1.1MB

Download
memory/1048-1-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1048-4-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1048-6-0x0000000000415000-0x0000000000416000-memory.dmp

Filesize
4KB

Download
memory/1048-7-0x0000000000400000-0x0000000000512000-memory.dmp

Filesize
1.1MB

Download