modiloader | 1648c32d086f9b4af712a6c8b3ab4c0eec2071d538e6002c403f99e4e26b4635

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 23:22

Target

17ead8e9d6b2ac70a963a2bfe55b3eb3_JaffaCakes118.exe
Size

512KB
MD5

17ead8e9d6b2ac70a963a2bfe55b3eb3
SHA1

8d262a304a46c2a90f00ca2fe6b94c93d43efb70
SHA256

1648c32d086f9b4af712a6c8b3ab4c0eec2071d538e6002c403f99e4e26b4635
SHA512

aeb6bb0c4a4dfc9feed23a60c16cd9c182db6eb610d740813a3eed5c421167470caf98da933faffbae91a070d2c9492a50790fa9bc2b931da13726532bdb368f
SSDEEP

12288:Re96JkRrBzE4LZA3mGwUOOgRBWc3c/m3mGAL7OARBWLDa:Re9syzLaWMSn1zWDlnb

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2372-9-0x0000000000400000-0x000000000051DEF2-memory.dmp	modiloader_stage2
behavioral1/memory/2372-16-0x0000000000400000-0x000000000051DEF2-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

Processes:

17ead8e9d6b2ac70a963a2bfe55b3eb3_JaffaCakes118.exe

description pid process target process

PID 2372 set thread context of 2980 2372 17ead8e9d6b2ac70a963a2bfe55b3eb3_JaffaCakes118.exe mstsc.exe
Drops file in Windows directory 1 IoCs

Processes:

17ead8e9d6b2ac70a963a2bfe55b3eb3_JaffaCakes118.exe

description ioc process

File created C:\Windows\SetupWay.txt 17ead8e9d6b2ac70a963a2bfe55b3eb3_JaffaCakes118.exe

description	pid	process	target process
PID 2372 set thread context of 2980	2372	17ead8e9d6b2ac70a963a2bfe55b3eb3_JaffaCakes118.exe	mstsc.exe

description	ioc	process
File created	C:\Windows\SetupWay.txt	17ead8e9d6b2ac70a963a2bfe55b3eb3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

17ead8e9d6b2ac70a963a2bfe55b3eb3_JaffaCakes118.exe

description	pid	process	target process
PID 2372 wrote to memory of 2980	2372	17ead8e9d6b2ac70a963a2bfe55b3eb3_JaffaCakes118.exe	mstsc.exe
PID 2372 wrote to memory of 2980	2372	17ead8e9d6b2ac70a963a2bfe55b3eb3_JaffaCakes118.exe	mstsc.exe
PID 2372 wrote to memory of 2980	2372	17ead8e9d6b2ac70a963a2bfe55b3eb3_JaffaCakes118.exe	mstsc.exe
PID 2372 wrote to memory of 2980	2372	17ead8e9d6b2ac70a963a2bfe55b3eb3_JaffaCakes118.exe	mstsc.exe
PID 2372 wrote to memory of 2980	2372	17ead8e9d6b2ac70a963a2bfe55b3eb3_JaffaCakes118.exe	mstsc.exe
PID 2372 wrote to memory of 2980	2372	17ead8e9d6b2ac70a963a2bfe55b3eb3_JaffaCakes118.exe	mstsc.exe
PID 2372 wrote to memory of 2980	2372	17ead8e9d6b2ac70a963a2bfe55b3eb3_JaffaCakes118.exe	mstsc.exe
PID 2372 wrote to memory of 2980	2372	17ead8e9d6b2ac70a963a2bfe55b3eb3_JaffaCakes118.exe	mstsc.exe
PID 2372 wrote to memory of 2980	2372	17ead8e9d6b2ac70a963a2bfe55b3eb3_JaffaCakes118.exe	mstsc.exe

memory/2372-0-0x0000000000400000-0x000000000051DEF2-memory.dmp

Filesize
1.1MB

Download
memory/2372-1-0x0000000000520000-0x000000000063E000-memory.dmp

Filesize
1.1MB

Download
memory/2372-2-0x0000000000520000-0x000000000063E000-memory.dmp

Filesize
1.1MB

Download
memory/2372-3-0x0000000000400000-0x000000000051DEF2-memory.dmp

Filesize
1.1MB

Download
memory/2372-5-0x0000000000400000-0x000000000051DEF2-memory.dmp

Filesize
1.1MB

Download
memory/2372-4-0x0000000000518000-0x0000000000519000-memory.dmp

Filesize
4KB

Download
memory/2372-6-0x0000000000400000-0x000000000051DEF2-memory.dmp

Filesize
1.1MB

Download
memory/2372-9-0x0000000000400000-0x000000000051DEF2-memory.dmp

Filesize
1.1MB

Download
memory/2372-16-0x0000000000400000-0x000000000051DEF2-memory.dmp

Filesize
1.1MB

Download
memory/2980-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2980-15-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download