Analysis

  • max time kernel
    92s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2024, 18:10

General

  • Target

    e58ade57fa5a5eececacbe15d9850f43_JaffaCakes118.exe

  • Size

    406KB

  • MD5

    e58ade57fa5a5eececacbe15d9850f43

  • SHA1

    691a0672f4456c03665f2d79f54d755c1c711adb

  • SHA256

    4d5f347cba7f989deae0cbd27a4fb01f949e15fffd6bc9ab23976b6b5762d37d

  • SHA512

    5a816e590104224f1b890385c07e4097b0ccc5196c63ebe193411d82464acf7abba225e5ab1b47d69e6111759125dfeb478ef4046eff46b267283b0390ec094c

  • SSDEEP

    6144:3yTKmTb35nIadDMmESU0Uy+zraTl6ZX+c4kajzPa6MtVr291q3356ikiiTNn:KtJIIMmE1aTluZ4kajzPLM7SK33Npi5n

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e58ade57fa5a5eececacbe15d9850f43_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e58ade57fa5a5eececacbe15d9850f43_JaffaCakes118.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3108-0-0x0000000000400000-0x00000000005A2000-memory.dmp

    Filesize

    1.6MB

  • memory/3108-1-0x00000000001C0000-0x00000000001DA000-memory.dmp

    Filesize

    104KB

  • memory/3108-2-0x00000000001C0000-0x00000000001DA000-memory.dmp

    Filesize

    104KB

  • memory/3108-3-0x0000000000400000-0x00000000005A2000-memory.dmp

    Filesize

    1.6MB