modiloader | bf401109300af3c0625f7e22d3238b01e89b18a880adcfd591ad60ded43fa73a

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe
Size

20KB
MD5

172036e57ae26f028aa4016c12d6a35e
SHA1

44714a097adfaac4be732b5afe2e6aee50dbb834
SHA256

bf401109300af3c0625f7e22d3238b01e89b18a880adcfd591ad60ded43fa73a
SHA512

86535e072b07bb94ec9c7b113fcd3b13e0885af2b4dda1e21dd86a35a358e832b405686622ccd717a36d0aade1a06de816115b1194b9873a8621a01e96d22ac8
SSDEEP

384:EqhdGOuHQHGEuYNcFiUdEwXZhtOfpTZjCXC9VZpzt/X37Dibr9lwBe6Bs:Rhd4QHGE5cFbdEwpHE7UC9/pzdbObrgG

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1808-0-0x0000000000400000-0x0000000000419000-memory.dmp	modiloader_stage2
behavioral1/memory/1936-20-0x0000000000400000-0x0000000000419000-memory.dmp	modiloader_stage2
behavioral1/memory/1808-21-0x0000000000400000-0x0000000000419000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

2.exe

pid process

1936 2.exe
Loads dropped DLL 2 IoCs

Processes:

172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe

pid process

1808 172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe
1808 172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe

pid	process
1936	2.exe

pid	process
1808	172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe
1808	172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe

Drops file in Program Files directory 4 IoCs

Processes:

172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Program Files\2.exe	172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe
File created	C:\Program Files\2.dll	172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe
File opened for modification	C:\Program Files\2.dll	172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe
File created	C:\Program Files\2.exe	172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2.exe172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe

pid process

1936 2.exe
1808 172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2.exe172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1936 2.exe
Token: SeDebugPrivilege 1808 172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe

pid	process
1936	2.exe
1808	172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1936	2.exe
Token: SeDebugPrivilege	1808	172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe2.exe

description	pid	process	target process
PID 1808 wrote to memory of 1936	1808	172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe	2.exe
PID 1808 wrote to memory of 1936	1808	172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe	2.exe
PID 1808 wrote to memory of 1936	1808	172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe	2.exe
PID 1808 wrote to memory of 1936	1808	172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe	2.exe
PID 1936 wrote to memory of 1240	1936	2.exe	Explorer.EXE
PID 1808 wrote to memory of 1240	1808	172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1240

C:\Users\Admin\AppData\Local\Temp\172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\172036e57ae26f028aa4016c12d6a35e_JaffaCakes118.exe"
2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808

C:\Program Files\2.exe
"C:\Program Files\2.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\2.exe
Filesize
20KB

MD5
172036e57ae26f028aa4016c12d6a35e

SHA1
44714a097adfaac4be732b5afe2e6aee50dbb834

SHA256
bf401109300af3c0625f7e22d3238b01e89b18a880adcfd591ad60ded43fa73a

SHA512
86535e072b07bb94ec9c7b113fcd3b13e0885af2b4dda1e21dd86a35a358e832b405686622ccd717a36d0aade1a06de816115b1194b9873a8621a01e96d22ac8

Download Submit
memory/1240-18-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/1808-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1808-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1808-9-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/1808-15-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/1808-21-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1936-17-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1936-16-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1936-20-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads