modiloader | c1ad8d78e155047dbe8cd1d253cbc899f1afe089a2af20d866375191933e17b7

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Poweliks.dun.exe
Size 362KB
Sample261006-v9c6faes2l
SHA256 c1ad8d78e155047dbe8cd1d253cbc899f1afe089a2af20d866375191933e17b7
MD5 a42abdd5fb8aa0fc81be726671896ca0
SHA1 b2efee6a7d7b0c44dbe06e59c1c77b9a7e86169b
SHA512 796fe517f9f628322f61bb054b546da09d0ec8b3f9a30261cac4bf571510d3e928be5de7a9af2c7929a5b0d38db149bc4fd7e263155fbe86e91aa4eef1fd4c86
SSDEEP 6144:wgBVtqihPxRw6uerZn7FeXLVWHoF2/MRbEQYLWQei3dnDKRgtxwxlj:wAtxhPJHrNEXLSGdhESZiZ1txwxN
TLSH
T19A84F3039F74C5F2D2674DB38C828753559B6914FA76F7F2DA03F6296FA21093063A82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery modiloader trojan

Malware Config

Signatures

Family: ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral2/memory/4720-2-0x0000000000400000-0x000000000043C000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3004 set thread context of 4720	3004	jaffacakes118_Trojan.Win32.Poweliks.dun.exe	90

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Poweliks.dun.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3004	jaffacakes118_Trojan.Win32.Poweliks.dun.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 4720	3004	jaffacakes118_Trojan.Win32.Poweliks.dun.exe	90
PID 3004 wrote to memory of 4720	3004	jaffacakes118_Trojan.Win32.Poweliks.dun.exe	90
PID 3004 wrote to memory of 4720	3004	jaffacakes118_Trojan.Win32.Poweliks.dun.exe	90
PID 3004 wrote to memory of 4720	3004	jaffacakes118_Trojan.Win32.Poweliks.dun.exe	90
PID 3004 wrote to memory of 4720	3004	jaffacakes118_Trojan.Win32.Poweliks.dun.exe	90
PID 3004 wrote to memory of 4720	3004	jaffacakes118_Trojan.Win32.Poweliks.dun.exe	90
PID 3004 wrote to memory of 4720	3004	jaffacakes118_Trojan.Win32.Poweliks.dun.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Poweliks.dun.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Poweliks.dun.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Poweliks.dun.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Poweliks.dun.exe"
  2⤵
  PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4720-2-0x0000000000400000-0x000000000043C000-memory.dmp

Download