modiloader | 1350f08c4cde248553c55ed93c168c5ad09b6a31e5925ea3a954fb765bf097ce

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 19:56

Target

1753500bb34f7140e39a3621a84e1503_JaffaCakes118.exe
Size

683KB
MD5

1753500bb34f7140e39a3621a84e1503
SHA1

30d3a7c71a8aedf812182b6a35bc1aef72eefd98
SHA256

1350f08c4cde248553c55ed93c168c5ad09b6a31e5925ea3a954fb765bf097ce
SHA512

a306b38e9a6d7f49f38523a08dba945a371012e1e17a575d6df9ddd741fd203f4d008aaa0c7d3f8d82f2552c2c99a1c3bb539353f339a7976f6d22e3d26d2e1b
SSDEEP

12288:zKjRaIQuIzsYPDz4xhLdn20XN8bkJcnYrK2t/dIOqSES7xNToA:SRaIQz7PDzK52098ADe2t/mSESlNToA

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
ModiLoader Second Stage 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2484-2-0x0000000000400000-0x00000000004BB000-memory.dmp modiloader_stage2
Drops file in Program Files directory 1 IoCs

Processes:

1753500bb34f7140e39a3621a84e1503_JaffaCakes118.exe

description ioc process

File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt 1753500bb34f7140e39a3621a84e1503_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/2484-2-0x0000000000400000-0x00000000004BB000-memory.dmp	modiloader_stage2

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt	1753500bb34f7140e39a3621a84e1503_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1753500bb34f7140e39a3621a84e1503_JaffaCakes118.exe

description	pid	process	target process
PID 2484 wrote to memory of 1264	2484	1753500bb34f7140e39a3621a84e1503_JaffaCakes118.exe	IEXPLORE.EXE
PID 2484 wrote to memory of 1264	2484	1753500bb34f7140e39a3621a84e1503_JaffaCakes118.exe	IEXPLORE.EXE
PID 2484 wrote to memory of 1264	2484	1753500bb34f7140e39a3621a84e1503_JaffaCakes118.exe	IEXPLORE.EXE
PID 2484 wrote to memory of 1264	2484	1753500bb34f7140e39a3621a84e1503_JaffaCakes118.exe	IEXPLORE.EXE

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
2⤵
PID:1264

memory/2484-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2484-2-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download