Analysis
- max time kernel
143s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
09/04/2024, 11:27
General
- Target e9e260825084e0e730956e3cfcaffbc4_JaffaCakes118.exe
- Size 683KB
- Sample240409-nkqa5sdg53
- SHA256 512ddfa6d29fe099a7e1257b0f72424df3b0f4c70eb0fee811e89d1609ef9a0f
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 2 IoCs
- Drops file in Program Files directory 1 IoCs
- Program crash 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9e260825084e0e730956e3cfcaffbc4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e9e260825084e0e730956e3cfcaffbc4_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 3322⤵
- Program crash
-
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 6522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4928 -ip 49281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4928 -ip 49281⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4928-0-0x0000000000400000-0x000000000056B000-memory.dmp
memory/4928-1-0x0000000000400000-0x000000000056B000-memory.dmp
memory/4928-2-0x0000000000B80000-0x0000000000BD4000-memory.dmp
memory/4928-3-0x0000000002490000-0x0000000002491000-memory.dmp
memory/4928-4-0x0000000000B60000-0x0000000000B61000-memory.dmp
memory/4928-5-0x00000000024C0000-0x00000000024C1000-memory.dmp
memory/4928-7-0x0000000000B30000-0x0000000000B31000-memory.dmp
memory/4928-6-0x0000000000B40000-0x0000000000B41000-memory.dmp
memory/4928-8-0x00000000024B0000-0x00000000024B1000-memory.dmp
memory/4928-9-0x00000000024A0000-0x00000000024A1000-memory.dmp
memory/4928-10-0x00000000024D0000-0x00000000024D1000-memory.dmp
memory/4928-11-0x0000000002550000-0x0000000002551000-memory.dmp
memory/4928-12-0x0000000002530000-0x0000000002531000-memory.dmp
memory/4928-13-0x0000000002580000-0x0000000002581000-memory.dmp
memory/4928-14-0x0000000002500000-0x0000000002501000-memory.dmp
memory/4928-15-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/4928-17-0x0000000002560000-0x0000000002561000-memory.dmp
memory/4928-16-0x0000000002570000-0x0000000002571000-memory.dmp
memory/4928-18-0x0000000002590000-0x0000000002591000-memory.dmp
memory/4928-19-0x0000000002520000-0x0000000002521000-memory.dmp
memory/4928-20-0x0000000002600000-0x0000000002601000-memory.dmp
memory/4928-21-0x00000000025E0000-0x00000000025E1000-memory.dmp
memory/4928-22-0x00000000025C0000-0x00000000025C1000-memory.dmp
memory/4928-23-0x00000000025B0000-0x00000000025B1000-memory.dmp
memory/4928-24-0x0000000002610000-0x0000000002611000-memory.dmp
memory/4928-25-0x00000000035F0000-0x00000000035F1000-memory.dmp
memory/4928-27-0x0000000000400000-0x000000000056B000-memory.dmp
memory/4928-28-0x0000000000400000-0x000000000056B000-memory.dmp
memory/4928-29-0x0000000000B80000-0x0000000000BD4000-memory.dmp