modiloader | 66c6e72c337baa70ca1f97fd86dd90516638a7e7e1eadc676ac644e752fe89d8

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 02:53

Target

3bba6f85a2547cd1abdc03144200ed16_JaffaCakes118.exe
Size

699KB
MD5

3bba6f85a2547cd1abdc03144200ed16
SHA1

d040b38bfadab3704c108b4f43daf7cb0ea551b9
SHA256

66c6e72c337baa70ca1f97fd86dd90516638a7e7e1eadc676ac644e752fe89d8
SHA512

72dfb3c27b29f136ac991acc477a1f68314bb10a2b3978b26e7430a482e2cb940c90bfdf3adda2b712096db5513549e4fd39d2aa655f77b52b39b8a09917b4da
SSDEEP

12288:bO38wMIr/1FYfvy3K7p8Iu5krPRI69nI27OGwpebmFTcURAA:aMwd/1F6yO8rGmchZws6FTRAA

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/4108-2-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt	3bba6f85a2547cd1abdc03144200ed16_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 5096	4108	3bba6f85a2547cd1abdc03144200ed16_JaffaCakes118.exe	83
PID 4108 wrote to memory of 5096	4108	3bba6f85a2547cd1abdc03144200ed16_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\3bba6f85a2547cd1abdc03144200ed16_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3bba6f85a2547cd1abdc03144200ed16_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4108
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:5096

memory/4108-1-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/4108-2-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download