modiloader | 4355f3e6023dabe7696e208c582c51939d70e2a6ffad7e075c2b56a74f0c9240

Analysis

max time kernel
138s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 13:34

Target

5c27467616eee5b44df966b5b55ae73e_JaffaCakes118.dll
Size

24KB
MD5

5c27467616eee5b44df966b5b55ae73e
SHA1

c00baf57949f8524761c82b561a0ae36d15d6b7e
SHA256

4355f3e6023dabe7696e208c582c51939d70e2a6ffad7e075c2b56a74f0c9240
SHA512

8987266338a3aa1eb66c3d324fc27566d51198b697354e3fd285e02a7b22499c5f1da7615e758e71a890adc48f4c2ef5187de8f0ce994676b8d0678f3ed29adf
SSDEEP

384:oSlPWzHE5+yiVtI89/rrtBiYTcJvu7JJZFX+lT6/ngOWD3AzurvP18D:F8DI8Z3fiYTMu7JElT6/nnurvtA

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/4000-0-0x00000000007A0000-0x00000000007AC000-memory.dmp	modiloader_stage2

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 4000	2784	regsvr32.exe	84
PID 2784 wrote to memory of 4000	2784	regsvr32.exe	84
PID 2784 wrote to memory of 4000	2784	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5c27467616eee5b44df966b5b55ae73e_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5c27467616eee5b44df966b5b55ae73e_JaffaCakes118.dll
  2⤵
  PID:4000

memory/4000-0-0x00000000007A0000-0x00000000007AC000-memory.dmp

Filesize
48KB

Download