modiloader | 2fe029649394358c965fc7ee953308f3b6d1fc2b4b3c21f874e9379326fc5024

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 03:15

Target

47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe
Size

663KB
MD5

47fad338d2c1f25e70226528758b7c60
SHA1

2b378f6531fbe95d492ed76449da600fa4a03536
SHA256

2fe029649394358c965fc7ee953308f3b6d1fc2b4b3c21f874e9379326fc5024
SHA512

359f2e503ac26efafb0b9aa1df540a3725f608e028ac521c0ec316bff1f4e6301ebe9f825ffc514a93d6e9bbc048303e49af0a84ad9ef36b16cbdb7f80ba78ad
SSDEEP

12288:ghE30QzL7Xt8mmF15NFqhDA7UqTBqxGp526sMMqM9prNuzIfXWi/hgRGgYCb+D0N:ghE3hv7XtBcz5DTBqGzCz9tUzIfXf/hO

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/708-1-0x0000000000010000-0x0000000000233000-memory.dmp	modiloader_stage2

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/708-0-0x0000000000010000-0x0000000000233000-memory.dmp	upx
behavioral1/memory/708-1-0x0000000000010000-0x0000000000233000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 708 set thread context of 2328	708	47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe	29

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2328	47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 2328	708	47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe	29
PID 708 wrote to memory of 2328	708	47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe	29
PID 708 wrote to memory of 2328	708	47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe	29
PID 708 wrote to memory of 2328	708	47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe	29
PID 708 wrote to memory of 2328	708	47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe	29
PID 708 wrote to memory of 2328	708	47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe	29
PID 708 wrote to memory of 2328	708	47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe	29
PID 708 wrote to memory of 2328	708	47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe	29
PID 708 wrote to memory of 2328	708	47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe	29
PID 708 wrote to memory of 2328	708	47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe	29
PID 708 wrote to memory of 2328	708	47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe	29
PID 708 wrote to memory of 2328	708	47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe	29
PID 708 wrote to memory of 2328	708	47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe	29
PID 708 wrote to memory of 2328	708	47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:708
- C:\Users\Admin\AppData\Local\Temp\47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe
  2⤵
  - Suspicious use of UnmapMainImage
  PID:2328

memory/708-2-0x0000000000850000-0x0000000000A73000-memory.dmp

Filesize
2.1MB

Download
memory/708-1-0x0000000000010000-0x0000000000233000-memory.dmp

Filesize
2.1MB

Download
memory/708-0-0x0000000000010000-0x0000000000233000-memory.dmp

Filesize
2.1MB

Download
memory/2328-19-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2328-5-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2328-21-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2328-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2328-17-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2328-16-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2328-13-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2328-11-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2328-9-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2328-7-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2328-3-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download