modiloader | 66c6e72c337baa70ca1f97fd86dd90516638a7e7e1eadc676ac644e752fe89d8

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 02:53

Target

3bba6f85a2547cd1abdc03144200ed16_JaffaCakes118.exe
Size

699KB
MD5

3bba6f85a2547cd1abdc03144200ed16
SHA1

d040b38bfadab3704c108b4f43daf7cb0ea551b9
SHA256

66c6e72c337baa70ca1f97fd86dd90516638a7e7e1eadc676ac644e752fe89d8
SHA512

72dfb3c27b29f136ac991acc477a1f68314bb10a2b3978b26e7430a482e2cb940c90bfdf3adda2b712096db5513549e4fd39d2aa655f77b52b39b8a09917b4da
SSDEEP

12288:bO38wMIr/1FYfvy3K7p8Iu5krPRI69nI27OGwpebmFTcURAA:aMwd/1F6yO8rGmchZws6FTRAA

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2444-2-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt	3bba6f85a2547cd1abdc03144200ed16_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2156	2444	3bba6f85a2547cd1abdc03144200ed16_JaffaCakes118.exe	30
PID 2444 wrote to memory of 2156	2444	3bba6f85a2547cd1abdc03144200ed16_JaffaCakes118.exe	30
PID 2444 wrote to memory of 2156	2444	3bba6f85a2547cd1abdc03144200ed16_JaffaCakes118.exe	30
PID 2444 wrote to memory of 2156	2444	3bba6f85a2547cd1abdc03144200ed16_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3bba6f85a2547cd1abdc03144200ed16_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3bba6f85a2547cd1abdc03144200ed16_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2444
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:2156

memory/2444-1-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2444-2-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download