modiloader | 5ca1e75eb315b5fe9f409aee44a1344bbdee673b0e7cbaffac33ace12c1ffb5e

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 08:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe
Size

537KB
MD5

1984d51fc9e907b5bc3444228be8fd9b
SHA1

6ed4e9121b69937e32243a57c1934627428e2911
SHA256

5ca1e75eb315b5fe9f409aee44a1344bbdee673b0e7cbaffac33ace12c1ffb5e
SHA512

d313782c22eedeb595aaed37dfdeb68fc3d2bfe99f6c4e6c0836e80d5330a7cc89cc663ebd5ea6af65f63b87fc42526cccb673d4e35ee191d5cebeec54350571
SSDEEP

12288:31GlRzSEY5cxxGjcmLKO9F3Z4mxxgv5bSRZsD8:3ORdEcecmR9QmXVoD8

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4932-46-0x0000000000400000-0x00000000004E0000-memory.dmp	modiloader_stage2
behavioral2/memory/872-48-0x0000000000400000-0x00000000004E0000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

ddos.exe

pid process

4932 ddos.exe

pid	process
4932	ddos.exe

Drops file in System32 directory 4 IoCs

Processes:

1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exeddos.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Deleteme.bat	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ddos.exe	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ddos.exe	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ddos.exe	ddos.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe

description	pid	process	target process
PID 872 wrote to memory of 4932	872	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe	ddos.exe
PID 872 wrote to memory of 4932	872	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe	ddos.exe
PID 872 wrote to memory of 4932	872	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe	ddos.exe
PID 872 wrote to memory of 4812	872	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe	cmd.exe
PID 872 wrote to memory of 4812	872	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe	cmd.exe
PID 872 wrote to memory of 4812	872	1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1984d51fc9e907b5bc3444228be8fd9b_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:872

C:\Windows\SysWOW64\ddos.exe
C:\Windows\system32\ddos.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4932

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
2⤵
PID:4812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Deleteme.bat
Filesize
212B

MD5
bca307359f9ea5765af8f3f935698354

SHA1
67988a411cd8d5b18c82a4e69a8f67852c8f17a0

SHA256
0c14f9a0782b21901e588b804f2ef888f038afddbcbd0b3bc266fb956d57734e

SHA512
1de0a87b9de6044065fb36cc02f099d86f7906a32d73f1a9f7668ba23a09bba897d03608d7561ea06b116f46d68b8912b45217bbbd7b7cbd2b2f3a708ca0f67c

Download Submit
C:\Windows\SysWOW64\ddos.exe
Filesize
537KB

MD5
1984d51fc9e907b5bc3444228be8fd9b

SHA1
6ed4e9121b69937e32243a57c1934627428e2911

SHA256
5ca1e75eb315b5fe9f409aee44a1344bbdee673b0e7cbaffac33ace12c1ffb5e

SHA512
d313782c22eedeb595aaed37dfdeb68fc3d2bfe99f6c4e6c0836e80d5330a7cc89cc663ebd5ea6af65f63b87fc42526cccb673d4e35ee191d5cebeec54350571

Download Submit
memory/872-24-0x00000000034F0000-0x00000000035F0000-memory.dmp

Filesize
1024KB

Download
memory/872-12-0x0000000003460000-0x0000000003462000-memory.dmp

Filesize
8KB

Download
memory/872-4-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/872-23-0x00000000034F0000-0x00000000035F0000-memory.dmp

Filesize
1024KB

Download
memory/872-18-0x00000000034F0000-0x00000000035F0000-memory.dmp

Filesize
1024KB

Download
memory/872-26-0x00000000034F0000-0x00000000035F0000-memory.dmp

Filesize
1024KB

Download
memory/872-16-0x00000000034F0000-0x00000000035F0000-memory.dmp

Filesize
1024KB

Download
memory/872-21-0x00000000034F0000-0x00000000035F0000-memory.dmp

Filesize
1024KB

Download
memory/872-11-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/872-10-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/872-9-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/872-8-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/872-7-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/872-3-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/872-2-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/872-20-0x00000000034F0000-0x00000000035F0000-memory.dmp

Filesize
1024KB

Download
memory/872-19-0x00000000034F0000-0x00000000035F0000-memory.dmp

Filesize
1024KB

Download
memory/872-22-0x00000000034F0000-0x00000000035F0000-memory.dmp

Filesize
1024KB

Download
memory/872-0-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/872-25-0x00000000034F0000-0x00000000035F0000-memory.dmp

Filesize
1024KB

Download
memory/872-13-0x00000000034F0000-0x00000000035F0000-memory.dmp

Filesize
1024KB

Download
memory/872-6-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/872-17-0x00000000034F0000-0x00000000035F0000-memory.dmp

Filesize
1024KB

Download
memory/872-28-0x00000000034F0000-0x00000000035F0000-memory.dmp

Filesize
1024KB

Download
memory/872-27-0x00000000034F0000-0x00000000035F0000-memory.dmp

Filesize
1024KB

Download
memory/872-29-0x00000000034F0000-0x00000000035F0000-memory.dmp

Filesize
1024KB

Download
memory/872-30-0x00000000034F0000-0x00000000035F0000-memory.dmp

Filesize
1024KB

Download
memory/872-31-0x00000000034F0000-0x00000000035F0000-memory.dmp

Filesize
1024KB

Download
memory/872-38-0x0000000003480000-0x0000000003481000-memory.dmp

Filesize
4KB

Download
memory/872-37-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/872-36-0x00000000034A0000-0x00000000034A1000-memory.dmp

Filesize
4KB

Download
memory/872-35-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/872-34-0x0000000000C10000-0x0000000000C11000-memory.dmp

Filesize
4KB

Download
memory/872-33-0x00000000034F0000-0x00000000035F0000-memory.dmp

Filesize
1024KB

Download
memory/872-32-0x00000000034F0000-0x00000000035F0000-memory.dmp

Filesize
1024KB

Download
memory/872-5-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/872-1-0x00000000022E0000-0x0000000002334000-memory.dmp

Filesize
336KB

Download
memory/872-49-0x00000000022E0000-0x0000000002334000-memory.dmp

Filesize
336KB

Download
memory/872-48-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4932-46-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/4932-42-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download