modiloader | dfe77d354c1829f6fffd8f59dd57cafca86e377050de75084f8c54f8ec460cfb

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 14:09

Target

1b96a24191f30139a9df192c8be29e1f_JaffaCakes118.exe
Size

290KB
MD5

1b96a24191f30139a9df192c8be29e1f
SHA1

0bd53253f6f149cec57045a5f39c0fe7ec600cfb
SHA256

dfe77d354c1829f6fffd8f59dd57cafca86e377050de75084f8c54f8ec460cfb
SHA512

4e28c40ed8c4423fa606cf7d216b52facae9b80a7bbfb2c9b53b74954e322035da67e96372db4b3408161d87d6b1473b11740fc995fc8ed5cb681d78ad2726e0
SSDEEP

6144:Ez72R6v3EgaKoWVmxNZNRDhGcF051OjyphTF/U6BC1yGkZJBav0v:Ez72BgGW0NZNFhGcF05kjWF/myPJs8

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
ModiLoader Second Stage 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2884-1-0x0000000000400000-0x00000000004C1000-memory.dmp modiloader_stage2
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

behavioral1/memory/2884-0-0x0000000000400000-0x00000000004C1000-memory.dmp upx
behavioral1/memory/2884-1-0x0000000000400000-0x00000000004C1000-memory.dmp upx
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3008 2884 WerFault.exe 1b96a24191f30139a9df192c8be29e1f_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/2884-1-0x0000000000400000-0x00000000004C1000-memory.dmp	modiloader_stage2

resource	yara_rule
behavioral1/memory/2884-0-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral1/memory/2884-1-0x0000000000400000-0x00000000004C1000-memory.dmp	upx

pid	pid_target	process	target process
3008	2884	WerFault.exe	1b96a24191f30139a9df192c8be29e1f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1b96a24191f30139a9df192c8be29e1f_JaffaCakes118.exe

description	pid	process	target process
PID 2884 wrote to memory of 3008	2884	1b96a24191f30139a9df192c8be29e1f_JaffaCakes118.exe	WerFault.exe
PID 2884 wrote to memory of 3008	2884	1b96a24191f30139a9df192c8be29e1f_JaffaCakes118.exe	WerFault.exe
PID 2884 wrote to memory of 3008	2884	1b96a24191f30139a9df192c8be29e1f_JaffaCakes118.exe	WerFault.exe
PID 2884 wrote to memory of 3008	2884	1b96a24191f30139a9df192c8be29e1f_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1b96a24191f30139a9df192c8be29e1f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b96a24191f30139a9df192c8be29e1f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 36
2⤵
- Program crash
PID:3008

memory/2884-0-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2884-1-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download