modiloader | a53bc2880d4f730f60cc98e61ff2cfc4e61acd22a85baddeacba3437764501c1

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 12:19

Target

1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
Size

175KB
MD5

1b46e9352a86eb3d00fa3b0ba17d8b8e
SHA1

9c930629f04f7c130daee729386c7aef28747225
SHA256

a53bc2880d4f730f60cc98e61ff2cfc4e61acd22a85baddeacba3437764501c1
SHA512

243748a1f3db9c62924217983d852906f734cff575671b665d7ee78bc6d6393d19bc684cb60a2741c9c42af4b39fa1446405452fc2e59939a05e66d47ff8cbd9
SSDEEP

3072:3hiRE8afybhFTB8Ce856ODW2zilIFJD3kM9qyVNBvULxRjfkOUhUwlz4umBxFmb/:3IpzVD56qtrUL38OUBF4cb2ZI

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1188-4-0x0000000020000000-0x000000002002C000-memory.dmp	modiloader_stage2
behavioral2/memory/1188-5-0x0000000020000000-0x000000002002C000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

Processes:

1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe

description pid process target process

PID 1188 set thread context of 4496 1188 1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe 1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4608 4496 WerFault.exe 1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
4752 1188 WerFault.exe 1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe

description	pid	process	target process
PID 1188 set thread context of 4496	1188	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe

pid	pid_target	process	target process
4608	4496	WerFault.exe	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
4752	1188	WerFault.exe	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe

description	pid	process	target process
PID 1188 wrote to memory of 4496	1188	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
PID 1188 wrote to memory of 4496	1188	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
PID 1188 wrote to memory of 4496	1188	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
PID 1188 wrote to memory of 4496	1188	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
PID 1188 wrote to memory of 4496	1188	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe	1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\1b46e9352a86eb3d00fa3b0ba17d8b8e_JaffaCakes118.exe
2⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 236
3⤵
- Program crash
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 456
2⤵
- Program crash
PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1188 -ip 1188
1⤵
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4496 -ip 4496
1⤵
PID:2332

memory/1188-4-0x0000000020000000-0x000000002002C000-memory.dmp

Filesize
176KB

Download
memory/1188-5-0x0000000020000000-0x000000002002C000-memory.dmp

Filesize
176KB

Download
memory/4496-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4496-2-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4496-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download