modiloader | eaf4edcfb000daf20c71df4db936b96c7cd66b108e5832fbab609e3848de77cc

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe
Size

538KB
MD5

1b7a399fe9f7737db25bc85f76a7aeaa
SHA1

218696935c98ac38a25fa267b2dfe9d1f76df9f1
SHA256

eaf4edcfb000daf20c71df4db936b96c7cd66b108e5832fbab609e3848de77cc
SHA512

971008dfb63355188421868ac4a837356a898e7b7933aa42204b164fb7adf71312c66bfe2b582100ec68dc4e317c4cc35fc7a294c00f0ecaaf149c1730f249fc
SSDEEP

12288:XNXi8Pg9rCudUTdp4CpNllF3Z4mxxNcVYLqagaRrS0p:EesCu+TACnllQmXSVYl3

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1408-31-0x0000000000400000-0x00000000004DD000-memory.dmp	modiloader_stage2
behavioral2/memory/4468-28-0x0000000000400000-0x00000000004DD000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

ddos.exe

pid process

4468 ddos.exe

pid	process
4468	ddos.exe

Drops file in System32 directory 4 IoCs

Processes:

1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exeddos.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ddos.exe	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ddos.exe	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ddos.exe	ddos.exe
File created	C:\Windows\SysWOW64\Deleteme.bat	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe

description	pid	process	target process
PID 1408 wrote to memory of 4468	1408	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe	ddos.exe
PID 1408 wrote to memory of 4468	1408	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe	ddos.exe
PID 1408 wrote to memory of 4468	1408	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe	ddos.exe
PID 1408 wrote to memory of 3856	1408	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe	cmd.exe
PID 1408 wrote to memory of 3856	1408	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe	cmd.exe
PID 1408 wrote to memory of 3856	1408	1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b7a399fe9f7737db25bc85f76a7aeaa_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1408

C:\Windows\SysWOW64\ddos.exe
C:\Windows\system32\ddos.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4468

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
2⤵
PID:3856

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Deleteme.bat
Filesize
212B

MD5
e822c833631d5dbbaf4bf9441d2bfe63

SHA1
cdb38a20b46941bebcde0a38fd80ab61b9bf677e

SHA256
604f141c4cbfdf801c1f9b2fb3a434d8e63a6a8e676bce92b4e0e3071d7902e8

SHA512
1442f2fb928662f77109ecf5fc5f3ca73e82b0d4cea0d7da88a90b173547ca7a65b8662e88cc97fab60d0df2c30e82bfda262301079c5877a0b6be406e215271

Download Submit
C:\Windows\SysWOW64\ddos.exe
Filesize
538KB

MD5
1b7a399fe9f7737db25bc85f76a7aeaa

SHA1
218696935c98ac38a25fa267b2dfe9d1f76df9f1

SHA256
eaf4edcfb000daf20c71df4db936b96c7cd66b108e5832fbab609e3848de77cc

SHA512
971008dfb63355188421868ac4a837356a898e7b7933aa42204b164fb7adf71312c66bfe2b582100ec68dc4e317c4cc35fc7a294c00f0ecaaf149c1730f249fc

Download Submit
memory/1408-7-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/1408-31-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/1408-15-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/1408-14-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/1408-13-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/1408-12-0x0000000003320000-0x0000000003323000-memory.dmp

Filesize
12KB

Download
memory/1408-11-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/1408-10-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/1408-9-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/1408-8-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/1408-1-0x0000000002170000-0x00000000021C4000-memory.dmp

Filesize
336KB

Download
memory/1408-16-0x0000000003350000-0x0000000003351000-memory.dmp

Filesize
4KB

Download
memory/1408-3-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/1408-4-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/1408-5-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/1408-2-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1408-18-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/1408-17-0x0000000003340000-0x0000000003341000-memory.dmp

Filesize
4KB

Download
memory/1408-0-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/1408-6-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/1408-32-0x0000000002170000-0x00000000021C4000-memory.dmp

Filesize
336KB

Download
memory/4468-29-0x0000000000760000-0x00000000007B4000-memory.dmp

Filesize
336KB

Download
memory/4468-28-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/4468-24-0x0000000000760000-0x00000000007B4000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads