modiloader | 4c9b662af5456797ea2652dff388e455ea4e9ad8464dd280813822ed15916ad3

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 11:01

Target

1b0a48a0b5db74a0a9579894563a0195_JaffaCakes118.exe
Size

91KB
MD5

1b0a48a0b5db74a0a9579894563a0195
SHA1

9bef25026e323ea8cef7be802353f832994eb645
SHA256

4c9b662af5456797ea2652dff388e455ea4e9ad8464dd280813822ed15916ad3
SHA512

75f5cd4bdf6c58df0f1ae2917e1a738dfb69b4590c78313956b9b6bde2e74e841bcd941285dbcf7ef02d34fe1087b43987e71dca7ac28de2c5fd907cc8eb4323
SSDEEP

1536:iLVyrqAQJHx+kZdTNeSFsPPySYWxRw5dWA6D+U5nwnIrokyUPS+ain6ec6:NzYRDTESSHyfxWA6D+U5n4IrokyeS+ay

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
ModiLoader Second Stage 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2176-0-0x0000000010000000-0x000000001001D000-memory.dmp modiloader_stage2
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2204 2176 WerFault.exe 1b0a48a0b5db74a0a9579894563a0195_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/2176-0-0x0000000010000000-0x000000001001D000-memory.dmp	modiloader_stage2

pid	pid_target	process	target process
2204	2176	WerFault.exe	1b0a48a0b5db74a0a9579894563a0195_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1b0a48a0b5db74a0a9579894563a0195_JaffaCakes118.exe

description	pid	process	target process
PID 2176 wrote to memory of 2204	2176	1b0a48a0b5db74a0a9579894563a0195_JaffaCakes118.exe	WerFault.exe
PID 2176 wrote to memory of 2204	2176	1b0a48a0b5db74a0a9579894563a0195_JaffaCakes118.exe	WerFault.exe
PID 2176 wrote to memory of 2204	2176	1b0a48a0b5db74a0a9579894563a0195_JaffaCakes118.exe	WerFault.exe
PID 2176 wrote to memory of 2204	2176	1b0a48a0b5db74a0a9579894563a0195_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1b0a48a0b5db74a0a9579894563a0195_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b0a48a0b5db74a0a9579894563a0195_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 136
2⤵
- Program crash
PID:2204

memory/2176-0-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download