modiloader | e0355cc1108c344d2981d1c2986b95a61f3f68a116e7d8af5887d39e44e5e609

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe
Size

384KB
MD5

184410ae28667691bb25ff3e75e969b7
SHA1

79ba2f56f87533b454d9418b99854af68c664c97
SHA256

e0355cc1108c344d2981d1c2986b95a61f3f68a116e7d8af5887d39e44e5e609
SHA512

af3f846fedbf4fe6bca74bb73e3baa55e2011e27924baffbfb868fd038cf0bf9c05f0439624e37c3f175fd941fb4d293a13201712a1b61b9a71589b56d9b6811
SSDEEP

6144:7cTx2F2idZecnl20lHRxp3gIVuYsQ5cOdeRb8iY91EEVKYVNkMf:7cT0F3Z4mxxx7sIcOa/Y91TVKgf

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
ModiLoader Second Stage 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2060-70-0x0000000003280000-0x00000000032A4000-memory.dmp modiloader_stage2
Loads dropped DLL 1 IoCs

Processes:

184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe

pid process

2060 184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe
Drops file in Program Files directory 1 IoCs

Processes:

184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe

description ioc process

File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\atmQQ2.dll 184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/2060-70-0x0000000003280000-0x00000000032A4000-memory.dmp	modiloader_stage2

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\atmQQ2.dll	184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe

pid	process
2060	184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe
2060	184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe
2060	184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe
2060	184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe

pid process

2060 184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2060

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\Common Files\Microsoft Shared\MSInfo\atmQQ2.dll
Filesize
20KB

MD5
b7ca50371776b7cd6e36c358b01bdf2e

SHA1
9e16a33ac4feac3a6d2278ab888a5b4531b86423

SHA256
3ceb53703d9f464a19a62618dccced21a87ac43ead06842df260122b826f245f

SHA512
12546bf2069ec4c50fc88eab3c1ba0f17301103a74bd794e6f8c6f9bbb4d093e6040250f3dcfb5c6771fcda1f4da6efee33bab72cd35dc196073b4ed9dda2f0c

Download Submit
memory/2060-1-0x0000000000350000-0x00000000003A4000-memory.dmp

Filesize
336KB

Download
memory/2060-0-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2060-12-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-11-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download
memory/2060-10-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/2060-9-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/2060-8-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/2060-7-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2060-6-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2060-5-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/2060-4-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/2060-3-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/2060-2-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2060-17-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-16-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-15-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-14-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-33-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-70-0x0000000003280000-0x00000000032A4000-memory.dmp

Filesize
144KB

Download
memory/2060-69-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-68-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-67-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-66-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-65-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-64-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-63-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-62-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-61-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-60-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-59-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-58-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-57-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-56-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-55-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-54-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-53-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-52-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-51-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-50-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-49-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-48-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-47-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-46-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-45-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-44-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-43-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-42-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-41-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-40-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-39-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-38-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-37-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-36-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-35-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-34-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-32-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-31-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-30-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-29-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-28-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-27-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-26-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-25-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-24-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-23-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-22-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-21-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-20-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-71-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2060-72-0x0000000000350000-0x00000000003A4000-memory.dmp

Filesize
336KB

Download
memory/2060-74-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-75-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-76-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download
memory/2060-77-0x0000000003180000-0x0000000003280000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads