modiloader | f1ec52b29ee7b25983fd7c939cceceb02fada1a9cf93eb178fea78fa22caf17a

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a6c14e8afe501f58c932a50541c6182_JaffaCakes118.exe
Size

594KB
MD5

1a6c14e8afe501f58c932a50541c6182
SHA1

720fd18148ff0352014806f5c511d1f06ea8aab7
SHA256

f1ec52b29ee7b25983fd7c939cceceb02fada1a9cf93eb178fea78fa22caf17a
SHA512

183499e5320b465e2e9be2c019ae7b83ede4796b1748c3e751bf8acf9f2d31956daa08210cdbaf850d59e43d60ccf1b064536edbec84cd83eb23ee6558de99f3
SSDEEP

12288:m73HpXwLT/99MSZXj9FBX5KGKf9qF3Z4mxxPOncTIT+5w8PVo:mLpA//oSF9FBJaYQmXP+cTItMo

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2492-59-0x0000000000400000-0x000000000055C000-memory.dmp	modiloader_stage2
behavioral2/memory/3240-65-0x0000000000400000-0x000000000055C000-memory.dmp	modiloader_stage2
behavioral2/memory/2492-68-0x0000000000400000-0x000000000055C000-memory.dmp	modiloader_stage2
behavioral2/memory/3240-71-0x0000000000400000-0x000000000055C000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

rej0.exe

pid process

3240 rej0.exe

pid	process
3240	rej0.exe

Drops file in Program Files directory 3 IoCs

Processes:

1a6c14e8afe501f58c932a50541c6182_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\rej0.exe	1a6c14e8afe501f58c932a50541c6182_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSINFO\rej0.exe	1a6c14e8afe501f58c932a50541c6182_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat	1a6c14e8afe501f58c932a50541c6182_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2644 3240 WerFault.exe rej0.exe

pid	pid_target	process	target process
2644	3240	WerFault.exe	rej0.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1a6c14e8afe501f58c932a50541c6182_JaffaCakes118.exerej0.exe

description	pid	process	target process
PID 2492 wrote to memory of 3240	2492	1a6c14e8afe501f58c932a50541c6182_JaffaCakes118.exe	rej0.exe
PID 2492 wrote to memory of 3240	2492	1a6c14e8afe501f58c932a50541c6182_JaffaCakes118.exe	rej0.exe
PID 2492 wrote to memory of 3240	2492	1a6c14e8afe501f58c932a50541c6182_JaffaCakes118.exe	rej0.exe
PID 3240 wrote to memory of 1724	3240	rej0.exe	IEXPLORE.EXE
PID 3240 wrote to memory of 1724	3240	rej0.exe	IEXPLORE.EXE
PID 2492 wrote to memory of 1496	2492	1a6c14e8afe501f58c932a50541c6182_JaffaCakes118.exe	cmd.exe
PID 2492 wrote to memory of 1496	2492	1a6c14e8afe501f58c932a50541c6182_JaffaCakes118.exe	cmd.exe
PID 2492 wrote to memory of 1496	2492	1a6c14e8afe501f58c932a50541c6182_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\1a6c14e8afe501f58c932a50541c6182_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a6c14e8afe501f58c932a50541c6182_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2492

C:\Program Files\Common Files\Microsoft Shared\MSINFO\rej0.exe
"C:\Program Files\Common Files\Microsoft Shared\MSINFO\rej0.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
3⤵
PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 664
3⤵
- Program crash
PID:2644

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat""
2⤵
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3240 -ip 3240
1⤵
PID:3740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\MSINFO\DelSvel.bat
Filesize
212B

MD5
400868b1bb900e256ac6f0adf3678905

SHA1
9125c1cc464e39f994bdf7fc15149845cc5487b9

SHA256
605cdaf394854fe35f9c6289ca450389bfce8c318bf9b798096decf7ab510fc8

SHA512
ab77798f3e22bf1010f65b973be1617c76eba5192c09033bdb71842c16f45feebbd2ec282911c5eec1546a85198b2f1f4dfde063476c298c44e57aa8ab0e374a

Download Submit
C:\Program Files\Common Files\microsoft shared\MSInfo\rej0.exe
Filesize
594KB

MD5
1a6c14e8afe501f58c932a50541c6182

SHA1
720fd18148ff0352014806f5c511d1f06ea8aab7

SHA256
f1ec52b29ee7b25983fd7c939cceceb02fada1a9cf93eb178fea78fa22caf17a

SHA512
183499e5320b465e2e9be2c019ae7b83ede4796b1748c3e751bf8acf9f2d31956daa08210cdbaf850d59e43d60ccf1b064536edbec84cd83eb23ee6558de99f3

Download Submit
memory/2492-0-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download
memory/2492-1-0x00000000023C0000-0x0000000002414000-memory.dmp

Filesize
336KB

Download
memory/2492-3-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/2492-2-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/2492-58-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-57-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-56-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-55-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-54-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-53-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-52-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-51-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-50-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-49-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-48-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-47-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-46-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-45-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-44-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-43-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-42-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-41-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-40-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-39-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-38-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-37-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-36-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-35-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-34-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-33-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-32-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-31-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-30-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-29-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-27-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-28-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-26-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-25-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-24-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-23-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-22-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-21-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-20-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-19-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-18-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-17-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-16-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2492-15-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2492-14-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2492-13-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2492-12-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2492-11-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2492-10-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/2492-9-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/2492-8-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/2492-7-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/2492-6-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/2492-5-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/2492-4-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/2492-59-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download
memory/2492-68-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download
memory/2492-69-0x00000000023C0000-0x0000000002414000-memory.dmp

Filesize
336KB

Download
memory/3240-65-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download
memory/3240-71-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download