modiloader | 4355f3e6023dabe7696e208c582c51939d70e2a6ffad7e075c2b56a74f0c9240

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 13:34

Target

5c27467616eee5b44df966b5b55ae73e_JaffaCakes118.dll
Size

24KB
MD5

5c27467616eee5b44df966b5b55ae73e
SHA1

c00baf57949f8524761c82b561a0ae36d15d6b7e
SHA256

4355f3e6023dabe7696e208c582c51939d70e2a6ffad7e075c2b56a74f0c9240
SHA512

8987266338a3aa1eb66c3d324fc27566d51198b697354e3fd285e02a7b22499c5f1da7615e758e71a890adc48f4c2ef5187de8f0ce994676b8d0678f3ed29adf
SSDEEP

384:oSlPWzHE5+yiVtI89/rrtBiYTcJvu7JJZFX+lT6/ngOWD3AzurvP18D:F8DI8Z3fiYTMu7JElT6/nnurvtA

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/1980-0-0x0000000000180000-0x000000000018C000-memory.dmp	modiloader_stage2

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1980	2072	regsvr32.exe	30
PID 2072 wrote to memory of 1980	2072	regsvr32.exe	30
PID 2072 wrote to memory of 1980	2072	regsvr32.exe	30
PID 2072 wrote to memory of 1980	2072	regsvr32.exe	30
PID 2072 wrote to memory of 1980	2072	regsvr32.exe	30
PID 2072 wrote to memory of 1980	2072	regsvr32.exe	30
PID 2072 wrote to memory of 1980	2072	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5c27467616eee5b44df966b5b55ae73e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5c27467616eee5b44df966b5b55ae73e_JaffaCakes118.dll
  2⤵
  PID:1980

memory/1980-0-0x0000000000180000-0x000000000018C000-memory.dmp

Filesize
48KB

Download