modiloader | d1c21ad3d39f1c3502a800d1d082f31fb4ca78c519b75c5c82148fc7f23fac55

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 19:16

Target

1c309851083983587ffe62b1c6a7cf18_JaffaCakes118.exe
Size

98KB
MD5

1c309851083983587ffe62b1c6a7cf18
SHA1

48b9622b9c32b2c153c5b131846be0af73513251
SHA256

d1c21ad3d39f1c3502a800d1d082f31fb4ca78c519b75c5c82148fc7f23fac55
SHA512

80db99c16ed9c4b521dbaea3b692e4bf75ab8a00653e053dbaddcd1cb5173f384d34f1d3b21a08ae535d79a8c57ecb4c7d950fde41a2e734bda983785a80ad6b
SSDEEP

3072:G3quF7c3jHz7YInISas6+ZLxkauVFXri:mJc3j/p++ZLxkdnXr

Score

10^/10

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4620-6-0x0000000000010000-0x0000000000036000-memory.dmp	modiloader_stage2
behavioral2/memory/2824-7-0x0000000000010000-0x0000000000036000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

apocalyps32.exe

pid process

2824 apocalyps32.exe

pid	process
2824	apocalyps32.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4620-0-0x0000000000010000-0x0000000000036000-memory.dmp	upx
C:\Windows\apocalyps32.exe	upx
behavioral2/memory/4620-6-0x0000000000010000-0x0000000000036000-memory.dmp	upx
behavioral2/memory/2824-7-0x0000000000010000-0x0000000000036000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

Processes:

1c309851083983587ffe62b1c6a7cf18_JaffaCakes118.exeapocalyps32.exe

description	ioc	process
File created	C:\Windows\apocalyps32.exe	1c309851083983587ffe62b1c6a7cf18_JaffaCakes118.exe
File opened for modification	C:\Windows\apocalyps32.exe	1c309851083983587ffe62b1c6a7cf18_JaffaCakes118.exe
File created	C:\Windows\apocalyps32.exe	apocalyps32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

1c309851083983587ffe62b1c6a7cf18_JaffaCakes118.exeapocalyps32.exe

description	pid	process	target process
PID 4620 wrote to memory of 2824	4620	1c309851083983587ffe62b1c6a7cf18_JaffaCakes118.exe	apocalyps32.exe
PID 4620 wrote to memory of 2824	4620	1c309851083983587ffe62b1c6a7cf18_JaffaCakes118.exe	apocalyps32.exe
PID 4620 wrote to memory of 2824	4620	1c309851083983587ffe62b1c6a7cf18_JaffaCakes118.exe	apocalyps32.exe
PID 2824 wrote to memory of 4604	2824	apocalyps32.exe	msedge.exe
PID 2824 wrote to memory of 4604	2824	apocalyps32.exe	msedge.exe

C:\Windows\apocalyps32.exe
Filesize
98KB

MD5
1c309851083983587ffe62b1c6a7cf18

SHA1
48b9622b9c32b2c153c5b131846be0af73513251

SHA256
d1c21ad3d39f1c3502a800d1d082f31fb4ca78c519b75c5c82148fc7f23fac55

SHA512
80db99c16ed9c4b521dbaea3b692e4bf75ab8a00653e053dbaddcd1cb5173f384d34f1d3b21a08ae535d79a8c57ecb4c7d950fde41a2e734bda983785a80ad6b

Download Submit
memory/2824-7-0x0000000000010000-0x0000000000036000-memory.dmp

Filesize
152KB

Download
memory/4620-0-0x0000000000010000-0x0000000000036000-memory.dmp

Filesize
152KB

Download
memory/4620-6-0x0000000000010000-0x0000000000036000-memory.dmp

Filesize
152KB

Download