modiloader | 91cbd548aac90e857da62262cd36d7afc3df0ea4e4e33a578045fdb86db6f520

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cb565836376e0f1b221ec1d6f5cf9fe_JaffaCakes118.exe
Size

623KB
MD5

1cb565836376e0f1b221ec1d6f5cf9fe
SHA1

698b6b94b739855d29c1de4e8079638cb180da64
SHA256

91cbd548aac90e857da62262cd36d7afc3df0ea4e4e33a578045fdb86db6f520
SHA512

c1a5202ff5df903ef9fe38a5c74d5910060129fb6f87709f4fd9d021c5ce81a19ea7cdd0d69d4120bce631b9fce1ff63d77c5d8b70b96ff2492eec85af9ce3ea
SSDEEP

12288:Hdh5r/2ZJQdfRpy06uThy756rSqOZLF3Z4mxxxwKlKlD0426IOtAfxp/odo7hXDs:9hFca1Rpy06jErSqgLQmXxw1D0426TA2

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2212-12-0x0000000003370000-0x0000000003470000-memory.dmp	modiloader_stage2
behavioral1/memory/2212-30-0x0000000000400000-0x000000000050F000-memory.dmp	modiloader_stage2

Drops file in Program Files directory 1 IoCs

Processes:

1cb565836376e0f1b221ec1d6f5cf9fe_JaffaCakes118.exe

description ioc process

File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\Fiele Ps.txt 1cb565836376e0f1b221ec1d6f5cf9fe_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\Fiele Ps.txt	1cb565836376e0f1b221ec1d6f5cf9fe_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1cb565836376e0f1b221ec1d6f5cf9fe_JaffaCakes118.exe

description	pid	process	target process
PID 2212 wrote to memory of 2436	2212	1cb565836376e0f1b221ec1d6f5cf9fe_JaffaCakes118.exe	IEXPLORE.EXE
PID 2212 wrote to memory of 2436	2212	1cb565836376e0f1b221ec1d6f5cf9fe_JaffaCakes118.exe	IEXPLORE.EXE
PID 2212 wrote to memory of 2436	2212	1cb565836376e0f1b221ec1d6f5cf9fe_JaffaCakes118.exe	IEXPLORE.EXE
PID 2212 wrote to memory of 2436	2212	1cb565836376e0f1b221ec1d6f5cf9fe_JaffaCakes118.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\1cb565836376e0f1b221ec1d6f5cf9fe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1cb565836376e0f1b221ec1d6f5cf9fe_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2212

C:\program files\internet explorer\IEXPLORE.EXE
"C:\program files\internet explorer\IEXPLORE.EXE"
2⤵
PID:2436

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-0-0x0000000000400000-0x000000000050F000-memory.dmp

Filesize
1.1MB

Download
memory/2212-1-0x0000000001E50000-0x0000000001EA4000-memory.dmp

Filesize
336KB

Download
memory/2212-11-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download
memory/2212-10-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download
memory/2212-19-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/2212-21-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/2212-20-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/2212-18-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/2212-17-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/2212-16-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/2212-15-0x0000000003470000-0x0000000003471000-memory.dmp

Filesize
4KB

Download
memory/2212-14-0x0000000003370000-0x0000000003372000-memory.dmp

Filesize
8KB

Download
memory/2212-13-0x0000000003380000-0x0000000003381000-memory.dmp

Filesize
4KB

Download
memory/2212-12-0x0000000003370000-0x0000000003470000-memory.dmp

Filesize
1024KB

Download
memory/2212-9-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/2212-8-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/2212-7-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/2212-28-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2212-27-0x0000000003400000-0x0000000003401000-memory.dmp

Filesize
4KB

Download
memory/2212-26-0x0000000003390000-0x0000000003391000-memory.dmp

Filesize
4KB

Download
memory/2212-25-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/2212-24-0x00000000033B0000-0x00000000033B1000-memory.dmp

Filesize
4KB

Download
memory/2212-23-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2212-22-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2212-6-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/2212-5-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/2212-4-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/2212-3-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/2212-2-0x00000000020D0000-0x00000000020D1000-memory.dmp

Filesize
4KB

Download
memory/2212-30-0x0000000000400000-0x000000000050F000-memory.dmp

Filesize
1.1MB

Download
memory/2212-31-0x0000000000415000-0x0000000000416000-memory.dmp

Filesize
4KB

Download
memory/2212-32-0x0000000001E50000-0x0000000001EA4000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads