modiloader | 4da14fe180b3a59e890f9c937910a19ffbb6cab5a45ed21cddd914c49fc5172b

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 05:45

Target

448cd4c6d24d8f86a5d51e695214882b_JaffaCakes118.exe
Size

67KB
MD5

448cd4c6d24d8f86a5d51e695214882b
SHA1

56ce176bbdd5ce4bc48cd33abfecf764cfbef92c
SHA256

4da14fe180b3a59e890f9c937910a19ffbb6cab5a45ed21cddd914c49fc5172b
SHA512

e9f3f07eca689b9ac0074ab40d06e0b4958151009905a84a46e3db2cc420195f93b8c998629ae76c293a8f633a454f5280b63de73b02c2b53db3abb525a910fa
SSDEEP

1536:p4jqi5axwdaPpVNbQ6V1WT9rZJ5EYP5D5qUUsKt:ujpaxGaPpVNbJHW3sYBlJu

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/3576-2-0x0000000010000000-0x0000000010017000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3576 set thread context of 3188	3576	448cd4c6d24d8f86a5d51e695214882b_JaffaCakes118.exe	83

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 3188	3576	448cd4c6d24d8f86a5d51e695214882b_JaffaCakes118.exe	83
PID 3576 wrote to memory of 3188	3576	448cd4c6d24d8f86a5d51e695214882b_JaffaCakes118.exe	83
PID 3576 wrote to memory of 3188	3576	448cd4c6d24d8f86a5d51e695214882b_JaffaCakes118.exe	83
PID 3576 wrote to memory of 3188	3576	448cd4c6d24d8f86a5d51e695214882b_JaffaCakes118.exe	83
PID 3576 wrote to memory of 3188	3576	448cd4c6d24d8f86a5d51e695214882b_JaffaCakes118.exe	83
PID 3188 wrote to memory of 3520	3188	448cd4c6d24d8f86a5d51e695214882b_JaffaCakes118.exe	56
PID 3188 wrote to memory of 3520	3188	448cd4c6d24d8f86a5d51e695214882b_JaffaCakes118.exe	56
PID 3188 wrote to memory of 3520	3188	448cd4c6d24d8f86a5d51e695214882b_JaffaCakes118.exe	56
PID 3188 wrote to memory of 3520	3188	448cd4c6d24d8f86a5d51e695214882b_JaffaCakes118.exe	56

memory/3188-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3188-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3188-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3188-5-0x0000000000570000-0x0000000000583000-memory.dmp

Filesize
76KB

Download
memory/3188-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3188-11-0x0000000000570000-0x0000000000583000-memory.dmp

Filesize
76KB

Download
memory/3520-6-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3520-7-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/3576-2-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download