modiloader | 4c9b662af5456797ea2652dff388e455ea4e9ad8464dd280813822ed15916ad3

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 11:01

Target

1b0a48a0b5db74a0a9579894563a0195_JaffaCakes118.exe
Size

91KB
MD5

1b0a48a0b5db74a0a9579894563a0195
SHA1

9bef25026e323ea8cef7be802353f832994eb645
SHA256

4c9b662af5456797ea2652dff388e455ea4e9ad8464dd280813822ed15916ad3
SHA512

75f5cd4bdf6c58df0f1ae2917e1a738dfb69b4590c78313956b9b6bde2e74e841bcd941285dbcf7ef02d34fe1087b43987e71dca7ac28de2c5fd907cc8eb4323
SSDEEP

1536:iLVyrqAQJHx+kZdTNeSFsPPySYWxRw5dWA6D+U5nwnIrokyUPS+ain6ec6:NzYRDTESSHyfxWA6D+U5n4IrokyeS+ay

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
ModiLoader Second Stage 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/3664-0-0x0000000010000000-0x000000001001D000-memory.dmp modiloader_stage2
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

944 3664 WerFault.exe 1b0a48a0b5db74a0a9579894563a0195_JaffaCakes118.exe

resource	yara_rule
behavioral2/memory/3664-0-0x0000000010000000-0x000000001001D000-memory.dmp	modiloader_stage2

pid	pid_target	process	target process
944	3664	WerFault.exe	1b0a48a0b5db74a0a9579894563a0195_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1b0a48a0b5db74a0a9579894563a0195_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b0a48a0b5db74a0a9579894563a0195_JaffaCakes118.exe"
1⤵
PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 400
2⤵
- Program crash
PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3664 -ip 3664
1⤵
PID:1188

memory/3664-0-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download