modiloader | 5cab085a62d34a1eea2d53d4607f1caca5ea26a7054d96f065878966c02a4eb5

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 19:27

Target

61173a47109fae5c416a48989df21b98_JaffaCakes118.exe
Size

717KB
MD5

61173a47109fae5c416a48989df21b98
SHA1

f2c7eacd192c6fde64b5d378befd5cd1235dc4e0
SHA256

5cab085a62d34a1eea2d53d4607f1caca5ea26a7054d96f065878966c02a4eb5
SHA512

dd8cc08809abb692bef53b356978fcbbaf84de4791848d7c15aa1f4399d5ede96627fa24521febfbd5cce8a9d6a577f8dece9ffe5fcc042ad43e032b593ae874
SSDEEP

12288:TXR9tJF/jbg/COUSuOM7PcPzxQtBqJPLSVSf7WPVZMl7f7yRs6EpF+bNj5KU3pLz:TB9tJ9jbg/CMdQPcPzxQ3YPO/Sl7f7yv

Score

10^/10

modiloader trojan

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral1/memory/2972-6-0x0000000000400000-0x0000000000666400-memory.dmp	modiloader_stage2
behavioral1/memory/2972-7-0x0000000000400000-0x0000000000666400-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt	61173a47109fae5c416a48989df21b98_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2648	2972	61173a47109fae5c416a48989df21b98_JaffaCakes118.exe	31
PID 2972 wrote to memory of 2648	2972	61173a47109fae5c416a48989df21b98_JaffaCakes118.exe	31
PID 2972 wrote to memory of 2648	2972	61173a47109fae5c416a48989df21b98_JaffaCakes118.exe	31
PID 2972 wrote to memory of 2648	2972	61173a47109fae5c416a48989df21b98_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\61173a47109fae5c416a48989df21b98_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\61173a47109fae5c416a48989df21b98_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2972
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  PID:2648

memory/2972-2-0x00000000005B3000-0x0000000000665000-memory.dmp

Filesize
712KB

Download
memory/2972-3-0x0000000000400000-0x0000000000666400-memory.dmp

Filesize
2.4MB

Download
memory/2972-1-0x0000000000400000-0x0000000000666400-memory.dmp

Filesize
2.4MB

Download
memory/2972-0-0x0000000000400000-0x0000000000666400-memory.dmp

Filesize
2.4MB

Download
memory/2972-4-0x0000000000400000-0x0000000000666400-memory.dmp

Filesize
2.4MB

Download
memory/2972-6-0x0000000000400000-0x0000000000666400-memory.dmp

Filesize
2.4MB

Download
memory/2972-7-0x0000000000400000-0x0000000000666400-memory.dmp

Filesize
2.4MB

Download
memory/2972-8-0x00000000034D0000-0x00000000034D3000-memory.dmp

Filesize
12KB

Download