modiloader | a53bc2880d4f730f60cc98e61ff2cfc4e61acd22a85baddeacba3437764501c1

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
Size

175KB
MD5

1b46e9352a86eb3d00fa3b0ba17d8b8e
SHA1

9c930629f04f7c130daee729386c7aef28747225
SHA256

a53bc2880d4f730f60cc98e61ff2cfc4e61acd22a85baddeacba3437764501c1
SHA512

243748a1f3db9c62924217983d852906f734cff575671b665d7ee78bc6d6393d19bc684cb60a2741c9c42af4b39fa1446405452fc2e59939a05e66d47ff8cbd9
SSDEEP

3072:3hiRE8afybhFTB8Ce856ODW2zilIFJD3kM9qyVNBvULxRjfkOUhUwlz4umBxFmb/:3IpzVD56qtrUL38OUBF4cb2ZI

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
ModiLoader Second Stage 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/1988-8-0x0000000020000000-0x000000002002C000-memory.dmp modiloader_stage2
Suspicious use of SetThreadContext 1 IoCs

Processes:

1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe

description pid process target process

PID 1988 set thread context of 1956 1988 1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe 1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1344 1988 WerFault.exe 1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
3004 1956 WerFault.exe 1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/1988-8-0x0000000020000000-0x000000002002C000-memory.dmp	modiloader_stage2

description	pid	process	target process
PID 1988 set thread context of 1956	1988	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe

pid	pid_target	process	target process
1344	1988	WerFault.exe	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
3004	1956	WerFault.exe	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe

description	pid	process	target process
PID 1988 wrote to memory of 1956	1988	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
PID 1988 wrote to memory of 1956	1988	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
PID 1988 wrote to memory of 1956	1988	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
PID 1988 wrote to memory of 1956	1988	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
PID 1988 wrote to memory of 1956	1988	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
PID 1988 wrote to memory of 1956	1988	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
PID 1988 wrote to memory of 1344	1988	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	WerFault.exe
PID 1988 wrote to memory of 1344	1988	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	WerFault.exe
PID 1988 wrote to memory of 1344	1988	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	WerFault.exe
PID 1988 wrote to memory of 1344	1988	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	WerFault.exe
PID 1956 wrote to memory of 3004	1956	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	WerFault.exe
PID 1956 wrote to memory of 3004	1956	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	WerFault.exe
PID 1956 wrote to memory of 3004	1956	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	WerFault.exe
PID 1956 wrote to memory of 3004	1956	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1988

C:\Users\Admin\AppData\Local\Temp\1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 88
3⤵
- Program crash
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 180
2⤵
- Program crash
PID:1344

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-1-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1956-4-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1956-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1956-6-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1956-7-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1988-8-0x0000000020000000-0x000000002002C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads