modiloader | c4d9f26384cd96e41e8517d831db9428116ee92596ad8dc67e2587feacf124a7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 19:57

Target

175437621ea5962443f3e0f0032786e1_JaffaCakes118.exe
Size

327KB
MD5

175437621ea5962443f3e0f0032786e1
SHA1

a833116064c77f393f34165a24e59e3d95fccc0d
SHA256

c4d9f26384cd96e41e8517d831db9428116ee92596ad8dc67e2587feacf124a7
SHA512

556b9837fb603218388d1020fb6161f6206d3afe5d044cd2533be432d82a370642cb4370afe7057062b300386e0d96eeacdfd64f069871db499987e3f02925a3
SSDEEP

6144:SU00cF8Nk7vKyI4ZkoNI8GFUng+O4Ro2KroYGxYbSqK1MjmxvB7HvGh0:C0cFwNYkeI8MIOio2KrDHz07H+h

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
ModiLoader Second Stage 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/3000-4-0x0000000000400000-0x000000000051D000-memory.dmp modiloader_stage2
Drops file in Program Files directory 1 IoCs

Processes:

175437621ea5962443f3e0f0032786e1_JaffaCakes118.exe

description ioc process

File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\paramstr.txt 175437621ea5962443f3e0f0032786e1_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/3000-4-0x0000000000400000-0x000000000051D000-memory.dmp	modiloader_stage2

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\paramstr.txt	175437621ea5962443f3e0f0032786e1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

175437621ea5962443f3e0f0032786e1_JaffaCakes118.exe

description	pid	process	target process
PID 3000 wrote to memory of 2204	3000	175437621ea5962443f3e0f0032786e1_JaffaCakes118.exe	IEXPLORE.EXE
PID 3000 wrote to memory of 2204	3000	175437621ea5962443f3e0f0032786e1_JaffaCakes118.exe	IEXPLORE.EXE
PID 3000 wrote to memory of 2204	3000	175437621ea5962443f3e0f0032786e1_JaffaCakes118.exe	IEXPLORE.EXE
PID 3000 wrote to memory of 2204	3000	175437621ea5962443f3e0f0032786e1_JaffaCakes118.exe	IEXPLORE.EXE

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
2⤵
PID:2204

memory/3000-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3000-0-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/3000-2-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/3000-4-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download