Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 04:39
Static task
static1
Behavioral task
behavioral1
Sample
7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe
-
Size
341KB
-
MD5
7459ea42f26b81d86c5faeffba79da69
-
SHA1
243aa5d88db570c42935474ef56a628db84d08e4
-
SHA256
0c4d0a3b3c48b4e400fe33f9f591654a83383526279d4507723f0bb32f13daea
-
SHA512
9789c84a9960b0246ff7125ec152794100288c00cc3998c1873c893f99bf7c9ac555db5787faa06f049951ea72caef114443ea631729fc9fc7daea13ec257162
-
SSDEEP
6144:vC8Amf14715ykoo8Sh9ILARFisIoCwI4sgVu:vCv84oooIFis1CwI4u
Malware Config
Extracted
lokibot
http://mooladharam.com/karbak/tamboora/karbk.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/4504-2-0x0000000002410000-0x0000000002430000-memory.dmp agile_net -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exedescription pid process target process PID 4504 set thread context of 2196 4504 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 4504 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exedescription pid process target process PID 4504 wrote to memory of 2196 4504 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe PID 4504 wrote to memory of 2196 4504 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe PID 4504 wrote to memory of 2196 4504 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe PID 4504 wrote to memory of 2196 4504 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe PID 4504 wrote to memory of 2196 4504 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe PID 4504 wrote to memory of 2196 4504 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe PID 4504 wrote to memory of 2196 4504 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe PID 4504 wrote to memory of 2196 4504 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe PID 4504 wrote to memory of 2196 4504 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe 7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7459ea42f26b81d86c5faeffba79da69_JaffaCakes118.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2196-8-0x0000000000550000-0x00000000005F2000-memory.dmpFilesize
648KB
-
memory/4504-0-0x000000007464E000-0x000000007464F000-memory.dmpFilesize
4KB
-
memory/4504-1-0x0000000000010000-0x0000000000068000-memory.dmpFilesize
352KB
-
memory/4504-2-0x0000000002410000-0x0000000002430000-memory.dmpFilesize
128KB
-
memory/4504-3-0x0000000004FE0000-0x0000000005584000-memory.dmpFilesize
5.6MB
-
memory/4504-4-0x0000000004B10000-0x0000000004BA2000-memory.dmpFilesize
584KB
-
memory/4504-5-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB
-
memory/4504-6-0x0000000005630000-0x00000000056CC000-memory.dmpFilesize
624KB
-
memory/4504-7-0x000000007464E000-0x000000007464F000-memory.dmpFilesize
4KB
-
memory/4504-11-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB