Overview

overview

10

Static

static

10

1a6b1936e3...18.exe

windows7-x64

10

1a6b1936e3...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    28-06-2024 14:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1a6b1936e3c109228eadc9ad4dc6dd6d_JaffaCakes118.exe

  • Size

    688KB

  • MD5

    1a6b1936e3c109228eadc9ad4dc6dd6d

  • SHA1

    de0d6c5a1065ac3c9fd8a8a1f71896ca0b89b08c

  • SHA256

    e701d460b83444afe90157e09929e97c22750969bb220a0a6a1e106586dd566e

  • SHA512

    cd6916773d5d4ff8cf94cdf7eaff26fab279955970938c9f06a91134fdef5400ab1ad1c2c84c354847badd6476ee2ec29dc0397f8b6121645da1555b049826a7

  • SSDEEP

    12288:vugl095nSxHxzsFb+4pbzsUn7XFLvEo7ezYRolLTK8:my0XSxH9so4pHZRTycoLT3

Score
10/10
modiloadertrojan

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • ModiLoader Second Stage 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1a6b1936e3c109228eadc9ad4dc6dd6d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1a6b1936e3c109228eadc9ad4dc6dd6d_JaffaCakes118.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1644
    • C:\program files\internet explorer\IEXPLORE.EXE
      "C:\program files\internet explorer\IEXPLORE.EXE"
      2⤵
        PID:2100

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1644-1-0x0000000000400000-0x00000000004C1000-memory.dmp
      Filesize

      772KB

      Download