modiloader | 2fe029649394358c965fc7ee953308f3b6d1fc2b4b3c21f874e9379326fc5024

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 03:15

Target

47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe
Size

663KB
MD5

47fad338d2c1f25e70226528758b7c60
SHA1

2b378f6531fbe95d492ed76449da600fa4a03536
SHA256

2fe029649394358c965fc7ee953308f3b6d1fc2b4b3c21f874e9379326fc5024
SHA512

359f2e503ac26efafb0b9aa1df540a3725f608e028ac521c0ec316bff1f4e6301ebe9f825ffc514a93d6e9bbc048303e49af0a84ad9ef36b16cbdb7f80ba78ad
SSDEEP

12288:ghE30QzL7Xt8mmF15NFqhDA7UqTBqxGp526sMMqM9prNuzIfXWi/hgRGgYCb+D0N:ghE3hv7XtBcz5DTBqGzCz9tUzIfXf/hO

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/2768-1-0x0000000000010000-0x0000000000233000-memory.dmp	modiloader_stage2

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2768-0-0x0000000000010000-0x0000000000233000-memory.dmp	upx
behavioral2/memory/2768-1-0x0000000000010000-0x0000000000233000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2664	2768	47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe	87
PID 2768 wrote to memory of 2664	2768	47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe	87
PID 2768 wrote to memory of 2664	2768	47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Users\Admin\AppData\Local\Temp\47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\47fad338d2c1f25e70226528758b7c60_JaffaCakes118.exe
  2⤵
  PID:2664

memory/2768-0-0x0000000000010000-0x0000000000233000-memory.dmp

Filesize
2.1MB

Download
memory/2768-1-0x0000000000010000-0x0000000000233000-memory.dmp

Filesize
2.1MB

Download