modiloader | eaf4edcfb000daf20c71df4db936b96c7cd66b108e5832fbab609e3848de77cc

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe
Size

538KB
MD5

1b7a399fe9f7737db25bc85f76a7aeaa
SHA1

218696935c98ac38a25fa267b2dfe9d1f76df9f1
SHA256

eaf4edcfb000daf20c71df4db936b96c7cd66b108e5832fbab609e3848de77cc
SHA512

971008dfb63355188421868ac4a837356a898e7b7933aa42204b164fb7adf71312c66bfe2b582100ec68dc4e317c4cc35fc7a294c00f0ecaaf149c1730f249fc
SSDEEP

12288:XNXi8Pg9rCudUTdp4CpNllF3Z4mxxNcVYLqagaRrS0p:EesCu+TACnllQmXSVYl3

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2644-63-0x0000000000400000-0x00000000004DD000-memory.dmp	modiloader_stage2
behavioral1/memory/2912-65-0x0000000000400000-0x00000000004DD000-memory.dmp	modiloader_stage2

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2512 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

ddos.exe

pid process

2644 ddos.exe
Loads dropped DLL 2 IoCs

Processes:

1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe

pid process

2912 1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe
2912 1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe

pid	process
2512	cmd.exe

pid	process
2644	ddos.exe

pid	process
2912	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe
2912	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

Processes:

ddos.exe1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ddos.exe	ddos.exe
File created	C:\Windows\SysWOW64\Deleteme.bat	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ddos.exe	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ddos.exe	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe

description	pid	process	target process
PID 2912 wrote to memory of 2644	2912	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe	ddos.exe
PID 2912 wrote to memory of 2644	2912	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe	ddos.exe
PID 2912 wrote to memory of 2644	2912	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe	ddos.exe
PID 2912 wrote to memory of 2644	2912	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe	ddos.exe
PID 2912 wrote to memory of 2512	2912	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe	cmd.exe
PID 2912 wrote to memory of 2512	2912	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe	cmd.exe
PID 2912 wrote to memory of 2512	2912	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe	cmd.exe
PID 2912 wrote to memory of 2512	2912	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\SysWOW64\ddos.exe
C:\Windows\system32\ddos.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2644

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Windows\system32\Deleteme.bat
2⤵
- Deletes itself
PID:2512

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Deleteme.bat
Filesize
212B

MD5
e822c833631d5dbbaf4bf9441d2bfe63

SHA1
cdb38a20b46941bebcde0a38fd80ab61b9bf677e

SHA256
604f141c4cbfdf801c1f9b2fb3a434d8e63a6a8e676bce92b4e0e3071d7902e8

SHA512
1442f2fb928662f77109ecf5fc5f3ca73e82b0d4cea0d7da88a90b173547ca7a65b8662e88cc97fab60d0df2c30e82bfda262301079c5877a0b6be406e215271

Download Submit
\Windows\SysWOW64\ddos.exe
Filesize
538KB

MD5
1b7a399fe9f7737db25bc85f76a7aeaa

SHA1
218696935c98ac38a25fa267b2dfe9d1f76df9f1

SHA256
eaf4edcfb000daf20c71df4db936b96c7cd66b108e5832fbab609e3848de77cc

SHA512
971008dfb63355188421868ac4a837356a898e7b7933aa42204b164fb7adf71312c66bfe2b582100ec68dc4e317c4cc35fc7a294c00f0ecaaf149c1730f249fc

Download Submit
memory/2644-52-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2644-53-0x0000000000750000-0x00000000007A4000-memory.dmp

Filesize
336KB

Download
memory/2644-63-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2644-64-0x0000000000750000-0x00000000007A4000-memory.dmp

Filesize
336KB

Download
memory/2912-16-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2912-11-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2912-33-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/2912-32-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/2912-31-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/2912-29-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/2912-28-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/2912-27-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/2912-26-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/2912-25-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/2912-24-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/2912-23-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/2912-22-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/2912-21-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/2912-20-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/2912-19-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2912-18-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2912-17-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2912-1-0x00000000004E0000-0x0000000000534000-memory.dmp

Filesize
336KB

Download
memory/2912-15-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2912-14-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2912-13-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2912-12-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2912-30-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/2912-10-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2912-9-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/2912-8-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/2912-7-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/2912-6-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2912-5-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2912-4-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/2912-3-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2912-2-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/2912-34-0x0000000003200000-0x0000000003203000-memory.dmp

Filesize
12KB

Download
memory/2912-36-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2912-41-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2912-40-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/2912-39-0x0000000003230000-0x0000000003231000-memory.dmp

Filesize
4KB

Download
memory/2912-38-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/2912-37-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2912-35-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2912-45-0x00000000042E0000-0x00000000043BD000-memory.dmp

Filesize
884KB

Download
memory/2912-65-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2912-0-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2912-66-0x00000000004E0000-0x0000000000534000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads