Analysis
-
max time kernel
144s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-06-2024 22:55
Static task
static1
Behavioral task
behavioral1
Sample
8fb8dec6e12d4cb320e9a10f72f3dc1e_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8fb8dec6e12d4cb320e9a10f72f3dc1e_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
8fb8dec6e12d4cb320e9a10f72f3dc1e_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
8fb8dec6e12d4cb320e9a10f72f3dc1e
-
SHA1
181ca1109b42aa4ed4211acc3e802353d58063ba
-
SHA256
7882347c14ed4d3a27ac3aebde40400b1c662ae548abd1d9af165cfaf5205f34
-
SHA512
ba9a860e370dfeb8379dc62059ffed654b686fb2f303c89e83b7416818d20259c28dd74d0da7d953555dd0af3381c840c007c43f59e1f1cca5a0cd5ada5bef9b
-
SSDEEP
24576:PpogCDjzcHuCVB2S/rGmrNQUgQDWzbnmAAFudCrHwQ:P25j0jGqiUPDT62
Malware Config
Extracted
lokibot
http://xojine.tech/bulo2/cat.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2492-1413-0x0000000010410000-0x0000000010449000-memory.dmp modiloader_stage2 behavioral1/memory/2492-1436-0x0000000010410000-0x0000000010449000-memory.dmp modiloader_stage2 -
Executes dropped EXE 3 IoCs
Processes:
jkcgjj.exejkcgjj.exejkcgjj.exepid process 2284 jkcgjj.exe 2492 jkcgjj.exe 2252 jkcgjj.exe -
Loads dropped DLL 4 IoCs
Processes:
8fb8dec6e12d4cb320e9a10f72f3dc1e_JaffaCakes118.exejkcgjj.exejkcgjj.exepid process 2868 8fb8dec6e12d4cb320e9a10f72f3dc1e_JaffaCakes118.exe 2868 8fb8dec6e12d4cb320e9a10f72f3dc1e_JaffaCakes118.exe 2284 jkcgjj.exe 2492 jkcgjj.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
jkcgjj.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook jkcgjj.exe Key opened \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook jkcgjj.exe Key opened \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook jkcgjj.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
jkcgjj.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\jkcgjj = "C:\\Users\\Admin\\AppData\\Local\\jkcgjj\\jkcgjj.vbs" jkcgjj.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
jkcgjj.exedescription pid process target process PID 2492 set thread context of 2252 2492 jkcgjj.exe jkcgjj.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
jkcgjj.exedescription pid process Token: SeDebugPrivilege 2252 jkcgjj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8fb8dec6e12d4cb320e9a10f72f3dc1e_JaffaCakes118.exejkcgjj.exedescription pid process target process PID 2868 wrote to memory of 2284 2868 8fb8dec6e12d4cb320e9a10f72f3dc1e_JaffaCakes118.exe jkcgjj.exe PID 2868 wrote to memory of 2284 2868 8fb8dec6e12d4cb320e9a10f72f3dc1e_JaffaCakes118.exe jkcgjj.exe PID 2868 wrote to memory of 2284 2868 8fb8dec6e12d4cb320e9a10f72f3dc1e_JaffaCakes118.exe jkcgjj.exe PID 2868 wrote to memory of 2284 2868 8fb8dec6e12d4cb320e9a10f72f3dc1e_JaffaCakes118.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe PID 2284 wrote to memory of 2492 2284 jkcgjj.exe jkcgjj.exe -
outlook_office_path 1 IoCs
Processes:
jkcgjj.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook jkcgjj.exe -
outlook_win_path 1 IoCs
Processes:
jkcgjj.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook jkcgjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fb8dec6e12d4cb320e9a10f72f3dc1e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8fb8dec6e12d4cb320e9a10f72f3dc1e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jkcgjj.exeC:\Users\Admin\AppData\Local\Temp\jkcgjj.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jkcgjj.exeC:\Users\Admin\AppData\Local\Temp\jkcgjj.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\jkcgjj.exe"C:\Users\Admin\AppData\Local\Temp\jkcgjj.exe"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\jkcgjj.jpgFilesize
210KB
MD5ae1f66f35e91307c390d79df14dd8d61
SHA15cf0816343af8eeccf2cb03ef8a370d4f08d73cf
SHA25621d36ac537a0a0cfaa0ae56edd0d40c8f7be1c5d2b58c6cefcdbfd6cb19741c0
SHA512c6da5920bd2ac42a35bb967b24bcd892ed2da77d83168c410c56e2c32f66726bf750e90e45ae0435827870a1fc85eb443a7a59fb438e6d8537da9ffebc70b904
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1298544033-3225604241-2703760938-1000\0f5007522459c86e95ffcc62f32308f1_e3fd1d67-4513-4809-a7f1-bf54bd53bdbcFilesize
46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1298544033-3225604241-2703760938-1000\0f5007522459c86e95ffcc62f32308f1_e3fd1d67-4513-4809-a7f1-bf54bd53bdbcFilesize
46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
\Users\Admin\AppData\Local\Temp\jkcgjj.exeFilesize
394KB
MD58b49d2c49c43b1f71e73ccc34f9b3da2
SHA1bd8c83684f42197eb4bf2f025dc1d52147a60f4d
SHA2569c1b99aadbfb33fdd546f147a84e6ef956d3e301de914b18ce56b7705b5a9412
SHA51261b6ab038f898384a71aa4a6d136eca390cdaa2bbca11cbf8743972ad1dc5167fb4c979591dd67000f0c50838be260a6d8f5c2c0f1d59dc146ad608fcbf1fe61
-
memory/2252-1433-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2252-1480-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2284-29-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/2284-12-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/2284-11-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2492-26-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2492-34-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB
-
memory/2492-1413-0x0000000010410000-0x0000000010449000-memory.dmpFilesize
228KB
-
memory/2492-21-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2492-1436-0x0000000010410000-0x0000000010449000-memory.dmpFilesize
228KB
-
memory/2868-0-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2868-9-0x0000000000400000-0x0000000000530000-memory.dmpFilesize
1.2MB