modiloader | 62318cab7413fd37529cea54d54ec19263a65e93efb3ec2bafc7e57dd0ab11bb

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 14:24

Target

1ba1dafaad9de091019841ce7d0edf3f_JaffaCakes118.dll
Size

20KB
MD5

1ba1dafaad9de091019841ce7d0edf3f
SHA1

9d807b602a12be5c0427b3513b54126452aa232e
SHA256

62318cab7413fd37529cea54d54ec19263a65e93efb3ec2bafc7e57dd0ab11bb
SHA512

d75031436ae6e10d6ab320f0fc2ffe65f3f18127ed4deded07dbfb1225fded363395435df113fba70692fdb2a48c62248b0d6598c98654e9935b89c0184349c7
SSDEEP

384:isUE2n+FbSBha+12uZrL/G675ZiKYWg/Ts5xLs/foNc2wmCqtwzI4:qjn+F0hai2gLn6KYImyc2wmxSzz

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
ModiLoader Second Stage 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/2256-0-0x0000000000400000-0x0000000000424000-memory.dmp modiloader_stage2

resource	yara_rule
behavioral2/memory/2256-0-0x0000000000400000-0x0000000000424000-memory.dmp	modiloader_stage2

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3052 wrote to memory of 2256	3052	regsvr32.exe	regsvr32.exe
PID 3052 wrote to memory of 2256	3052	regsvr32.exe	regsvr32.exe
PID 3052 wrote to memory of 2256	3052	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1ba1dafaad9de091019841ce7d0edf3f_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3052

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\1ba1dafaad9de091019841ce7d0edf3f_JaffaCakes118.dll
2⤵
PID:2256

memory/2256-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download