modiloader | 5870d8562a0e6b852669e4267ac8bea934e233ba58037bb22ed75747c35a3df0

Analysis

max time kernel
141s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 07:13

Target

193ecb4e619b141d076587d6735f8904_JaffaCakes118.exe
Size

373KB
MD5

193ecb4e619b141d076587d6735f8904
SHA1

71b66dd93ea263911337e1ffa6e3b94d3be59c27
SHA256

5870d8562a0e6b852669e4267ac8bea934e233ba58037bb22ed75747c35a3df0
SHA512

adf5cc214378f15df7e0f0e004d64f149feffeca9c0db16a2284408431e584892594edd20c5c326cb5a596ee23a502e010e5cbff265ee33806a14555a513c644
SSDEEP

6144:bzyHFtvnxoP2P2zGlIXm6D8hqrTI0rWSYHwWKzDxVOKENkf8AZQWY9WdjxL:bGFtvxoOr8DHT/qERtEOfvQWLdj

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4664-0-0x0000000000400000-0x0000000000505000-memory.dmp	modiloader_stage2
behavioral2/memory/4664-1-0x0000000000400000-0x0000000000505000-memory.dmp	modiloader_stage2

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1496 4664 WerFault.exe 193ecb4e619b141d076587d6735f8904_JaffaCakes118.exe
3488 4664 WerFault.exe 193ecb4e619b141d076587d6735f8904_JaffaCakes118.exe

pid	pid_target	process	target process
1496	4664	WerFault.exe	193ecb4e619b141d076587d6735f8904_JaffaCakes118.exe
3488	4664	WerFault.exe	193ecb4e619b141d076587d6735f8904_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\193ecb4e619b141d076587d6735f8904_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\193ecb4e619b141d076587d6735f8904_JaffaCakes118.exe"
1⤵
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 252
2⤵
- Program crash
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 288
2⤵
- Program crash
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4664 -ip 4664
1⤵
PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4664 -ip 4664
1⤵
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3144,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
1⤵
PID:3680

memory/4664-0-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/4664-1-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download