modiloader | b6ed2056e0e835f3bf63462f4181cb65776b387b0d022cd3dd847f55b0501aa6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 01:26

Target

1849686692c9e8268efee927eff3d1f5_JaffaCakes118.exe
Size

675KB
MD5

1849686692c9e8268efee927eff3d1f5
SHA1

6bd6b2308b9c15577546f53934afa3d7efd219bd
SHA256

b6ed2056e0e835f3bf63462f4181cb65776b387b0d022cd3dd847f55b0501aa6
SHA512

89bcabca80b39df485081f731609a1e052317c7cb1e3b612ee659c5c442dd556339fe3b79fdaa0365ff0274c132685e8ade81d2f3d980e442d47b7e367375a3d
SSDEEP

12288:bw8INEKT8XOaLKbi+jZdFH1/nrcuyvh9gmJVsEiTp/:knNE9+aLdenHdrQEmJiEiT1

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
ModiLoader Second Stage 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/1992-2-0x0000000000400000-0x00000000004BA000-memory.dmp modiloader_stage2
Drops file in Program Files directory 1 IoCs

Processes:

1849686692c9e8268efee927eff3d1f5_JaffaCakes118.exe

description ioc process

File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\Fiele Ps.txt 1849686692c9e8268efee927eff3d1f5_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/1992-2-0x0000000000400000-0x00000000004BA000-memory.dmp	modiloader_stage2

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Fiele Ps.txt	1849686692c9e8268efee927eff3d1f5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1849686692c9e8268efee927eff3d1f5_JaffaCakes118.exe

description	pid	process	target process
PID 1992 wrote to memory of 2600	1992	1849686692c9e8268efee927eff3d1f5_JaffaCakes118.exe	IEXPLORE.EXE
PID 1992 wrote to memory of 2600	1992	1849686692c9e8268efee927eff3d1f5_JaffaCakes118.exe	IEXPLORE.EXE
PID 1992 wrote to memory of 2600	1992	1849686692c9e8268efee927eff3d1f5_JaffaCakes118.exe	IEXPLORE.EXE
PID 1992 wrote to memory of 2600	1992	1849686692c9e8268efee927eff3d1f5_JaffaCakes118.exe	IEXPLORE.EXE

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
2⤵
PID:2600

memory/1992-1-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1992-2-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download