modiloader | 4d5103192e78425daa38b2bf589d44d22a1081d8993af9d8830d15b686a508f3

Analysis

max time kernel
133s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
Size

244KB
MD5

1bc5c9316e96c1e084c637324adb5ab4
SHA1

5b0e20005021e8535463eb368114f7fe8dd09733
SHA256

4d5103192e78425daa38b2bf589d44d22a1081d8993af9d8830d15b686a508f3
SHA512

27e09570a1f7cb8eb6da61264de59f584befc10616151fddaf32d431a8c02e716a98bf137f32a6ab72d19b2363e7e14e8c2a5caaa1b67c75fb769c3c14b121a4
SSDEEP

6144:VtDO5bDO5XZXxS97mkWJ9HGeF2V+YXxH1MitwfV1Q:a525pXqSkWJBJTIHufVC

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4136-3-0x0000000000400000-0x0000000000432000-memory.dmp	modiloader_stage2
behavioral2/memory/4136-5-0x0000000000400000-0x0000000000432000-memory.dmp	modiloader_stage2
behavioral2/memory/4136-4-0x0000000000400000-0x0000000000432000-memory.dmp	modiloader_stage2
behavioral2/memory/4136-6-0x0000000000400000-0x0000000000432000-memory.dmp	modiloader_stage2
behavioral2/memory/4136-7-0x0000000000400000-0x0000000000432000-memory.dmp	modiloader_stage2
behavioral2/memory/4136-15-0x0000000000400000-0x0000000000432000-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

Processes:

1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe

description pid process target process

PID 3776 set thread context of 4136 3776 1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe 1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4452 4136 WerFault.exe 1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe

pid process

4136 1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
4136 1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe

pid process

3776 1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe

description	pid	process	target process
PID 3776 set thread context of 4136	3776	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe

pid	pid_target	process	target process
4452	4136	WerFault.exe	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe

pid	process
4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe

pid	process
3776	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe

description	pid	process	target process
PID 3776 wrote to memory of 4136	3776	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
PID 3776 wrote to memory of 4136	3776	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
PID 3776 wrote to memory of 4136	3776	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
PID 3776 wrote to memory of 4136	3776	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
PID 3776 wrote to memory of 4136	3776	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
PID 3776 wrote to memory of 4136	3776	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
PID 3776 wrote to memory of 4136	3776	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
PID 3776 wrote to memory of 4136	3776	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
PID 3776 wrote to memory of 4136	3776	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
PID 3776 wrote to memory of 4136	3776	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
PID 3776 wrote to memory of 4136	3776	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
PID 3776 wrote to memory of 4136	3776	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
PID 3776 wrote to memory of 4136	3776	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe
PID 4136 wrote to memory of 4304	4136	1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776

C:\Users\Admin\AppData\Local\Temp\1bc5c9316e96c1e084c637324adb5ab4_JaffaCakes118.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4136

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 448
3⤵
- Program crash
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4136 -ip 4136
1⤵
PID:3236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4136-3-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4136-5-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4136-4-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4136-6-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4136-7-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4136-8-0x0000000010410000-0x0000000010449000-memory.dmp

Filesize
228KB

Download
memory/4136-9-0x0000000010410000-0x0000000010449000-memory.dmp

Filesize
228KB

Download
memory/4136-15-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download