modiloader | bb007ae5543c0ef0cbdc7fe6cd6e9b399a3859819786f6ff7f8a9943db00fb9e

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b2945045c936b2a179bb90b06627212_JaffaCakes118.dll
Size

13KB
MD5

1b2945045c936b2a179bb90b06627212
SHA1

1d7cef09336a6ab555edf6a0512070874dd8cf8a
SHA256

bb007ae5543c0ef0cbdc7fe6cd6e9b399a3859819786f6ff7f8a9943db00fb9e
SHA512

cb8e706b702d8728acb50b3aae4cd8260404946d8d119af536f17639147f9111f1f005a380fb87bfbe12cfbf61f498835eef369a3a4ab6f25817a9099d10e129
SSDEEP

192:nrxb5P9o3QkK0alOR9lVTner8bIjZpqdDvyTuDXVPh09dbQnYBgMaNB/nbY9:bP9bkqlw9ltegE/q5vtDXBqDbkt8

Score

10^/10

modiloader trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 15 IoCs

Processes:

resource	yara_rule
behavioral1/memory/820-3-0x0000000000130000-0x000000000013E000-memory.dmp	modiloader_stage2
behavioral1/memory/820-5-0x0000000000130000-0x000000000013E000-memory.dmp	modiloader_stage2
behavioral1/memory/820-6-0x0000000000130000-0x000000000013E000-memory.dmp	modiloader_stage2
behavioral1/memory/820-10-0x0000000000130000-0x000000000013E000-memory.dmp	modiloader_stage2
behavioral1/memory/820-11-0x0000000000130000-0x000000000013E000-memory.dmp	modiloader_stage2
behavioral1/memory/820-12-0x0000000000130000-0x000000000013E000-memory.dmp	modiloader_stage2
behavioral1/memory/820-13-0x0000000000130000-0x000000000013E000-memory.dmp	modiloader_stage2
behavioral1/memory/820-14-0x0000000000130000-0x000000000013E000-memory.dmp	modiloader_stage2
behavioral1/memory/820-15-0x0000000000130000-0x000000000013E000-memory.dmp	modiloader_stage2
behavioral1/memory/820-16-0x0000000000130000-0x000000000013E000-memory.dmp	modiloader_stage2
behavioral1/memory/820-17-0x0000000000130000-0x000000000013E000-memory.dmp	modiloader_stage2
behavioral1/memory/820-18-0x0000000000130000-0x000000000013E000-memory.dmp	modiloader_stage2
behavioral1/memory/820-19-0x0000000000130000-0x000000000013E000-memory.dmp	modiloader_stage2
behavioral1/memory/820-20-0x0000000000130000-0x000000000013E000-memory.dmp	modiloader_stage2
behavioral1/memory/820-21-0x0000000000130000-0x000000000013E000-memory.dmp	modiloader_stage2

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/820-3-0x0000000000130000-0x000000000013E000-memory.dmp	upx
behavioral1/memory/820-5-0x0000000000130000-0x000000000013E000-memory.dmp	upx
behavioral1/memory/820-6-0x0000000000130000-0x000000000013E000-memory.dmp	upx
behavioral1/memory/820-10-0x0000000000130000-0x000000000013E000-memory.dmp	upx
behavioral1/memory/820-11-0x0000000000130000-0x000000000013E000-memory.dmp	upx
behavioral1/memory/820-12-0x0000000000130000-0x000000000013E000-memory.dmp	upx
behavioral1/memory/820-13-0x0000000000130000-0x000000000013E000-memory.dmp	upx
behavioral1/memory/820-14-0x0000000000130000-0x000000000013E000-memory.dmp	upx
behavioral1/memory/820-15-0x0000000000130000-0x000000000013E000-memory.dmp	upx
behavioral1/memory/820-16-0x0000000000130000-0x000000000013E000-memory.dmp	upx
behavioral1/memory/820-17-0x0000000000130000-0x000000000013E000-memory.dmp	upx
behavioral1/memory/820-18-0x0000000000130000-0x000000000013E000-memory.dmp	upx
behavioral1/memory/820-19-0x0000000000130000-0x000000000013E000-memory.dmp	upx
behavioral1/memory/820-20-0x0000000000130000-0x000000000013E000-memory.dmp	upx
behavioral1/memory/820-21-0x0000000000130000-0x000000000013E000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\ntdetect.pol rundll32.exe
File opened for modification C:\Windows\ntdetect.pol rundll32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

820 rundll32.exe

description	ioc	process
File created	C:\Windows\ntdetect.pol	rundll32.exe
File opened for modification	C:\Windows\ntdetect.pol	rundll32.exe

pid	process
820	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2320 wrote to memory of 820	2320	rundll32.exe	rundll32.exe
PID 2320 wrote to memory of 820	2320	rundll32.exe	rundll32.exe
PID 2320 wrote to memory of 820	2320	rundll32.exe	rundll32.exe
PID 2320 wrote to memory of 820	2320	rundll32.exe	rundll32.exe
PID 2320 wrote to memory of 820	2320	rundll32.exe	rundll32.exe
PID 2320 wrote to memory of 820	2320	rundll32.exe	rundll32.exe
PID 2320 wrote to memory of 820	2320	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b2945045c936b2a179bb90b06627212_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b2945045c936b2a179bb90b06627212_JaffaCakes118.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
PID:820

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/820-0-0x0000000000120000-0x000000000012E000-memory.dmp

Filesize
56KB

Download
memory/820-3-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download
memory/820-2-0x0000000000120000-0x000000000012E000-memory.dmp

Filesize
56KB

Download
memory/820-1-0x0000000000120000-0x000000000012E000-memory.dmp

Filesize
56KB

Download
memory/820-5-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download
memory/820-6-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download
memory/820-7-0x0000000000120000-0x000000000012E000-memory.dmp

Filesize
56KB

Download
memory/820-8-0x0000000000120000-0x000000000012E000-memory.dmp

Filesize
56KB

Download
memory/820-9-0x0000000000120000-0x000000000012E000-memory.dmp

Filesize
56KB

Download
memory/820-10-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download
memory/820-11-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download
memory/820-12-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download
memory/820-13-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download
memory/820-14-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download
memory/820-15-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download
memory/820-16-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download
memory/820-17-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download
memory/820-18-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download
memory/820-19-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download
memory/820-20-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download
memory/820-21-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads