modiloader | 0d77d68d7622f60fc75c151a02288c884e0c52c13f530e3e7278c4201bddef7a

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 20:42

Target

1773dc720356ee9b44728824cd549083_JaffaCakes118.exe
Size

300KB
MD5

1773dc720356ee9b44728824cd549083
SHA1

e3822e208f9834f29fcd0688a8ed2e00d4d24025
SHA256

0d77d68d7622f60fc75c151a02288c884e0c52c13f530e3e7278c4201bddef7a
SHA512

1cdcdc0db58b6fd5fc726782a42b7376bcc8634538c4be46446a0bc97306db2038d96f8f69d353163a486039f6d534b8837edf98bd997cfc1ede75b02a129be3
SSDEEP

6144:DguFsTWP8PGhbHl7i4avkM2E/4Qjvf9F3693p4Syf4NjjlITStof9wG0K:RsTWP88bHBi4avKQbHgp4Syf4ljkjfKo

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1304-0-0x0000000000400000-0x00000000004BB52C-memory.dmp	modiloader_stage2
behavioral1/memory/1304-2-0x0000000000400000-0x00000000004BB52C-memory.dmp	modiloader_stage2
behavioral1/memory/1304-1-0x0000000000400000-0x00000000004BB52C-memory.dmp	modiloader_stage2
behavioral1/memory/1304-4-0x0000000000401000-0x0000000000499000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

Processes:

1773dc720356ee9b44728824cd549083_JaffaCakes118.exe

description ioc process

File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\Fiele Ps.txt 1773dc720356ee9b44728824cd549083_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Fiele Ps.txt	1773dc720356ee9b44728824cd549083_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1773dc720356ee9b44728824cd549083_JaffaCakes118.exe

description	pid	process	target process
PID 1304 wrote to memory of 1484	1304	1773dc720356ee9b44728824cd549083_JaffaCakes118.exe	IEXPLORE.EXE
PID 1304 wrote to memory of 1484	1304	1773dc720356ee9b44728824cd549083_JaffaCakes118.exe	IEXPLORE.EXE
PID 1304 wrote to memory of 1484	1304	1773dc720356ee9b44728824cd549083_JaffaCakes118.exe	IEXPLORE.EXE
PID 1304 wrote to memory of 1484	1304	1773dc720356ee9b44728824cd549083_JaffaCakes118.exe	IEXPLORE.EXE

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
2⤵
PID:1484

memory/1304-0-0x0000000000400000-0x00000000004BB52C-memory.dmp

Filesize
749KB

Download
memory/1304-2-0x0000000000400000-0x00000000004BB52C-memory.dmp

Filesize
749KB

Download
memory/1304-1-0x0000000000400000-0x00000000004BB52C-memory.dmp

Filesize
749KB

Download
memory/1304-4-0x0000000000401000-0x0000000000499000-memory.dmp

Filesize
608KB

Download