modiloader | 41699ad99079830c50a938e33ec49c76645477efa2d993c13a7ec01bd48e65f0

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16e885a93bb3f19bc9e75377f1cb605e_JaffaCakes118.exe
Size

91KB
MD5

16e885a93bb3f19bc9e75377f1cb605e
SHA1

aae388065985f5be63bab7bd4486cae2145fdf3e
SHA256

41699ad99079830c50a938e33ec49c76645477efa2d993c13a7ec01bd48e65f0
SHA512

640c9bbe8c46571ec5aef0c3dc35ecbba85a097eea8f669dca38a216a52f17ce07fc98b09c77624dac94f09a81e9cd8d64167059e4a07ccf4473e17a1975b96f
SSDEEP

1536:irq5KUQeq5LYoNZLpY8CmJRz6bQsKnTSWPCrOWrZ4grGJ9y7K:rKUnoLPNZy+/nt0O7gyW7K

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2392-0-0x0000000000400000-0x000000000041C000-memory.dmp	modiloader_stage2
behavioral1/memory/2392-4-0x0000000000400000-0x000000000041C000-memory.dmp	modiloader_stage2

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

ping.exe

pid process

1940 ping.exe

pid	process
1940	ping.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

16e885a93bb3f19bc9e75377f1cb605e_JaffaCakes118.exe

description	pid	process	target process
PID 2392 wrote to memory of 1940	2392	16e885a93bb3f19bc9e75377f1cb605e_JaffaCakes118.exe	ping.exe
PID 2392 wrote to memory of 1940	2392	16e885a93bb3f19bc9e75377f1cb605e_JaffaCakes118.exe	ping.exe
PID 2392 wrote to memory of 1940	2392	16e885a93bb3f19bc9e75377f1cb605e_JaffaCakes118.exe	ping.exe
PID 2392 wrote to memory of 1940	2392	16e885a93bb3f19bc9e75377f1cb605e_JaffaCakes118.exe	ping.exe

C:\Users\Admin\AppData\Local\Temp\16e885a93bb3f19bc9e75377f1cb605e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\16e885a93bb3f19bc9e75377f1cb605e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2392

C:\Windows\SysWOW64\ping.exe
ping
2⤵
- Runs ping.exe
PID:1940

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2392-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2392-4-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download