modiloader | f3877d4ca2e0a0d63b73c8d5663b2464e994169ab8ec6b750e8a12b61740a11d

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 08:22

Target

1a954961189a7e817869af51fb4479b7_JaffaCakes118.exe
Size

768KB
MD5

1a954961189a7e817869af51fb4479b7
SHA1

c44e2121761538335d6a4beb071f0078b68163c4
SHA256

f3877d4ca2e0a0d63b73c8d5663b2464e994169ab8ec6b750e8a12b61740a11d
SHA512

2bfe6522f44579800b9bc26cf136eda7107e872730febd9969bfee0ebe0e83a706da7685ba763a35bcddb41fb2184f7ddefe3624095783e6d0690d96336c2f73
SSDEEP

6144:bycwCEcmMYUXbKy1tuwzogPwpznM0YDEjhzhRAi64xNJTfo1rRZqRX/akhj40JT:ZLhmHwOSoZBlM/Ajh/Aj4hjkwFawTd

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
ModiLoader Second Stage 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2480-1-0x0000000000400000-0x00000000004C0200-memory.dmp modiloader_stage2
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1624 2480 WerFault.exe 1a954961189a7e817869af51fb4479b7_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/2480-1-0x0000000000400000-0x00000000004C0200-memory.dmp	modiloader_stage2

pid	pid_target	process	target process
1624	2480	WerFault.exe	1a954961189a7e817869af51fb4479b7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1a954961189a7e817869af51fb4479b7_JaffaCakes118.exe

description	pid	process	target process
PID 2480 wrote to memory of 1624	2480	1a954961189a7e817869af51fb4479b7_JaffaCakes118.exe	WerFault.exe
PID 2480 wrote to memory of 1624	2480	1a954961189a7e817869af51fb4479b7_JaffaCakes118.exe	WerFault.exe
PID 2480 wrote to memory of 1624	2480	1a954961189a7e817869af51fb4479b7_JaffaCakes118.exe	WerFault.exe
PID 2480 wrote to memory of 1624	2480	1a954961189a7e817869af51fb4479b7_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1a954961189a7e817869af51fb4479b7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a954961189a7e817869af51fb4479b7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 36
2⤵
- Program crash
PID:1624

memory/2480-0-0x0000000000400000-0x00000000004C0200-memory.dmp

Filesize
768KB

Download
memory/2480-1-0x0000000000400000-0x00000000004C0200-memory.dmp

Filesize
768KB

Download