modiloader | 5ca1e75eb315b5fe9f409aee44a1344bbdee673b0e7cbaffac33ace12c1ffb5e

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 08:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe
Size

537KB
MD5

1984d51fc9e907b5bc3444228be8fd9b
SHA1

6ed4e9121b69937e32243a57c1934627428e2911
SHA256

5ca1e75eb315b5fe9f409aee44a1344bbdee673b0e7cbaffac33ace12c1ffb5e
SHA512

d313782c22eedeb595aaed37dfdeb68fc3d2bfe99f6c4e6c0836e80d5330a7cc89cc663ebd5ea6af65f63b87fc42526cccb673d4e35ee191d5cebeec54350571
SSDEEP

12288:31GlRzSEY5cxxGjcmLKO9F3Z4mxxgv5bSRZsD8:3ORdEcecmR9QmXVoD8

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2524-50-0x0000000000400000-0x00000000004E0000-memory.dmp	modiloader_stage2
behavioral1/memory/2920-57-0x0000000000400000-0x00000000004E0000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2528 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

ddos.exe

pid process

2524 ddos.exe
Loads dropped DLL 2 IoCs

Processes:

1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe

pid process

2920 1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe
2920 1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe

pid	process
2528	cmd.exe

pid	process
2524	ddos.exe

pid	process
2920	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe
2920	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

Processes:

1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exeddos.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ddos.exe	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ddos.exe	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ddos.exe	ddos.exe
File created	C:\Windows\SysWOW64\Deleteme.bat	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe

description	pid	process	target process
PID 2920 wrote to memory of 2524	2920	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe	ddos.exe
PID 2920 wrote to memory of 2524	2920	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe	ddos.exe
PID 2920 wrote to memory of 2524	2920	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe	ddos.exe
PID 2920 wrote to memory of 2524	2920	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe	ddos.exe
PID 2920 wrote to memory of 2528	2920	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe	cmd.exe
PID 2920 wrote to memory of 2528	2920	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe	cmd.exe
PID 2920 wrote to memory of 2528	2920	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe	cmd.exe
PID 2920 wrote to memory of 2528	2920	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2920

C:\Windows\SysWOW64\ddos.exe
C:\Windows\system32\ddos.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2524

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Windows\system32\Deleteme.bat
2⤵
- Deletes itself
PID:2528

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Deleteme.bat
Filesize
212B

MD5
bca307359f9ea5765af8f3f935698354

SHA1
67988a411cd8d5b18c82a4e69a8f67852c8f17a0

SHA256
0c14f9a0782b21901e588b804f2ef888f038afddbcbd0b3bc266fb956d57734e

SHA512
1de0a87b9de6044065fb36cc02f099d86f7906a32d73f1a9f7668ba23a09bba897d03608d7561ea06b116f46d68b8912b45217bbbd7b7cbd2b2f3a708ca0f67c

Download Submit
\Windows\SysWOW64\ddos.exe
Filesize
537KB

MD5
1984d51fc9e907b5bc3444228be8fd9b

SHA1
6ed4e9121b69937e32243a57c1934627428e2911

SHA256
5ca1e75eb315b5fe9f409aee44a1344bbdee673b0e7cbaffac33ace12c1ffb5e

SHA512
d313782c22eedeb595aaed37dfdeb68fc3d2bfe99f6c4e6c0836e80d5330a7cc89cc663ebd5ea6af65f63b87fc42526cccb673d4e35ee191d5cebeec54350571

Download Submit
memory/2524-50-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2524-46-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2920-20-0x0000000003200000-0x0000000003202000-memory.dmp

Filesize
8KB

Download
memory/2920-19-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/2920-16-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2920-15-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2920-14-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2920-13-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2920-12-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2920-11-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2920-10-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

Filesize
4KB

Download
memory/2920-9-0x0000000001F60000-0x0000000001F61000-memory.dmp

Filesize
4KB

Download
memory/2920-8-0x0000000001F30000-0x0000000001F31000-memory.dmp

Filesize
4KB

Download
memory/2920-6-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/2920-5-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/2920-34-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/2920-3-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download
memory/2920-2-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/2920-0-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2920-21-0x0000000003290000-0x0000000003390000-memory.dmp

Filesize
1024KB

Download
memory/2920-57-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/2920-17-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2920-4-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2920-33-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2920-32-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/2920-31-0x0000000003230000-0x0000000003231000-memory.dmp

Filesize
4KB

Download
memory/2920-30-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2920-29-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2920-28-0x0000000003290000-0x0000000003390000-memory.dmp

Filesize
1024KB

Download
memory/2920-27-0x0000000003290000-0x0000000003390000-memory.dmp

Filesize
1024KB

Download
memory/2920-26-0x0000000003290000-0x0000000003390000-memory.dmp

Filesize
1024KB

Download
memory/2920-25-0x0000000003290000-0x0000000003390000-memory.dmp

Filesize
1024KB

Download
memory/2920-24-0x0000000003290000-0x0000000003390000-memory.dmp

Filesize
1024KB

Download
memory/2920-18-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2920-38-0x0000000004250000-0x0000000004330000-memory.dmp

Filesize
896KB

Download
memory/2920-23-0x0000000003290000-0x0000000003390000-memory.dmp

Filesize
1024KB

Download
memory/2920-45-0x0000000004250000-0x0000000004330000-memory.dmp

Filesize
896KB

Download
memory/2920-7-0x0000000001F40000-0x0000000001F41000-memory.dmp

Filesize
4KB

Download
memory/2920-1-0x0000000001CA0000-0x0000000001CF4000-memory.dmp

Filesize
336KB

Download
memory/2920-22-0x0000000003290000-0x0000000003390000-memory.dmp

Filesize
1024KB

Download
memory/2920-59-0x0000000001CA0000-0x0000000001CF4000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads