modiloader | cd3f1ec25f5995a59c82e3ead6c9c7abd92d3848b1609b0ff5420065aa0a3b01

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 02:56

Target

4c8537d20cc6cdb8d63a7720de431184_JaffaCakes118.exe
Size

357KB
MD5

4c8537d20cc6cdb8d63a7720de431184
SHA1

0adc369f7d0a15bcb9704abfba8262e764eff8d6
SHA256

cd3f1ec25f5995a59c82e3ead6c9c7abd92d3848b1609b0ff5420065aa0a3b01
SHA512

fd3c87020edfdee5d961cba271de920a6438701f0dada8da8579a0bddac01f00c8601c00dab44ecee296b745733a987cf266a048c5d1b97602b3b94bafe17bd0
SSDEEP

6144:W4fxb0AyMtSvmbvszGgSjS+I3ncDkw/F/U3MGXgXCoO/Uv2Z/z6pPN+L5R:db0Ay6egKGgSjcn+kwUMG3Zuv+LX

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2244-4-0x0000000000400000-0x00000000004C8000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\2010.txt	4c8537d20cc6cdb8d63a7720de431184_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2792	2244	4c8537d20cc6cdb8d63a7720de431184_JaffaCakes118.exe	30
PID 2244 wrote to memory of 2792	2244	4c8537d20cc6cdb8d63a7720de431184_JaffaCakes118.exe	30
PID 2244 wrote to memory of 2792	2244	4c8537d20cc6cdb8d63a7720de431184_JaffaCakes118.exe	30
PID 2244 wrote to memory of 2792	2244	4c8537d20cc6cdb8d63a7720de431184_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\4c8537d20cc6cdb8d63a7720de431184_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4c8537d20cc6cdb8d63a7720de431184_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2244
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:2792

memory/2244-0-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/2244-1-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2244-2-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/2244-4-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/2244-5-0x0000000000415000-0x0000000000416000-memory.dmp

Filesize
4KB

Download