Overview

overview

10

Static

static

3

00e82d1749...18.exe

windows7-x64

10

00e82d1749...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    19-06-2024 22:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    00e82d1749e5d636fe123145909535a8_JaffaCakes118.exe

  • Size

    35KB

  • MD5

    00e82d1749e5d636fe123145909535a8

  • SHA1

    9fda3372cd164e49893e7e7d0dccee8a84cd3413

  • SHA256

    3d13bd742354c37651adaad71091c9510db0e596570bcc8497efbf98e2521bd1

  • SHA512

    81f44098588f52b2ff9282a4c485ef224dcea04aeb0553902e14ff8997ae4097cf02e2ba04703683cc308b63ca13a98c62b89fbf9a7b4bf0df1e63e11479ba51

  • SSDEEP

    768:p11ZCrVD1tuLAXGX2g0ClGe65c+azbKUKrxLiZEK8hKuuTYe0IRl:X2VZMkXGn8XcUxeZEK8UxVRl

Score
10/10
modiloadertrojan

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • ModiLoader Second Stage 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\00e82d1749e5d636fe123145909535a8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\00e82d1749e5d636fe123145909535a8_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Program Files\Common Files\Microsoft Shared\MSInfo\atmQQ2.dll
    Filesize

    25KB

    MD5

    f45fba65ddd38aae9a4b54052d642e11

    SHA1

    6926b3502e007f9cf9dc21eefb03eaca71823a7e

    SHA256

    eeff588f8f86a4516508d56c80e84ae23509a073fbe707d6fba8f8d7a3a352c4

    SHA512

    5cfce8c1f338dd32a59aa29ef4401c3797e27e577f4275faf665bb537d3f0174ca7e5f2eb448703a46b51f60efc2068da68761de0e708e3500792d2e6fddc3ff

    Download Submit
  • memory/2944-0-0x0000000000400000-0x0000000000425000-memory.dmp
    Filesize

    148KB

    Download
  • memory/2944-5-0x0000000000240000-0x0000000000241000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2944-4-0x0000000000220000-0x000000000023F000-memory.dmp
    Filesize

    124KB

    Download
  • memory/2944-6-0x0000000000400000-0x0000000000425000-memory.dmp
    Filesize

    148KB

    Download
  • memory/2944-8-0x0000000000240000-0x0000000000241000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2944-7-0x0000000000220000-0x000000000023F000-memory.dmp
    Filesize

    124KB

    Download