modiloader | e0355cc1108c344d2981d1c2986b95a61f3f68a116e7d8af5887d39e44e5e609

Analysis

max time kernel
142s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe
Size

384KB
MD5

184410ae28667691bb25ff3e75e969b7
SHA1

79ba2f56f87533b454d9418b99854af68c664c97
SHA256

e0355cc1108c344d2981d1c2986b95a61f3f68a116e7d8af5887d39e44e5e609
SHA512

af3f846fedbf4fe6bca74bb73e3baa55e2011e27924baffbfb868fd038cf0bf9c05f0439624e37c3f175fd941fb4d293a13201712a1b61b9a71589b56d9b6811
SSDEEP

6144:7cTx2F2idZecnl20lHRxp3gIVuYsQ5cOdeRb8iY91EEVKYVNkMf:7cT0F3Z4mxxx7sIcOa/Y91TVKgf

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
ModiLoader Second Stage 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4420-84-0x00000000034A0000-0x00000000034C4000-memory.dmp modiloader_stage2
Loads dropped DLL 2 IoCs

Processes:

184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe

pid process

4420 184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe
4420 184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe
Drops file in Program Files directory 1 IoCs

Processes:

184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe

description ioc process

File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\atmQQ2.dll 184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe

resource	yara_rule
behavioral2/memory/4420-84-0x00000000034A0000-0x00000000034C4000-memory.dmp	modiloader_stage2

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\atmQQ2.dll	184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe

pid	process
4420	184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe
4420	184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe
4420	184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe
4420	184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe
4420	184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe
4420	184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe
4420	184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe
4420	184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe

pid process

4420 184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\184410ae28667691bb25ff3e75e969b7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\MSInfo\atmQQ2.dll
Filesize
20KB

MD5
b7ca50371776b7cd6e36c358b01bdf2e

SHA1
9e16a33ac4feac3a6d2278ab888a5b4531b86423

SHA256
3ceb53703d9f464a19a62618dccced21a87ac43ead06842df260122b826f245f

SHA512
12546bf2069ec4c50fc88eab3c1ba0f17301103a74bd794e6f8c6f9bbb4d093e6040250f3dcfb5c6771fcda1f4da6efee33bab72cd35dc196073b4ed9dda2f0c

Download Submit
memory/4420-3-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/4420-9-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/4420-11-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/4420-10-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/4420-8-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4420-7-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/4420-6-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/4420-5-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/4420-4-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/4420-2-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4420-1-0x0000000000740000-0x0000000000794000-memory.dmp

Filesize
336KB

Download
memory/4420-0-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4420-19-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-18-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-20-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-21-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-24-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-23-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-22-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-25-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-27-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-26-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-28-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-34-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-33-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-36-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-43-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-53-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-57-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-69-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-78-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-84-0x00000000034A0000-0x00000000034C4000-memory.dmp

Filesize
144KB

Download
memory/4420-83-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-82-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-81-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-80-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-79-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-77-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-76-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-75-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-74-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-73-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-72-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-71-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-70-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-68-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-67-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-66-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-65-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-64-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-63-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-62-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-61-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-60-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-59-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-58-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-56-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-55-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-54-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-52-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-51-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-50-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-49-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-48-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-47-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-46-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-45-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-44-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-42-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-41-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-40-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-39-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-38-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-37-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-35-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-32-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-31-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-30-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-29-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-85-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4420-87-0x0000000000740000-0x0000000000794000-memory.dmp

Filesize
336KB

Download
memory/4420-88-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-89-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-90-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-99-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-97-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-96-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-95-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-94-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-93-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-92-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-91-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-100-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-98-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-101-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download
memory/4420-102-0x00000000032A0000-0x00000000033A0000-memory.dmp

Filesize
1024KB

Download