Malware Analysis Report

2024-08-06 14:19

Sample ID 240619-2vnf7azeml
Target 010017e186c37470c1208876f7bb2db3_JaffaCakes118
SHA256 a475322f26172f4dad7c67d1f01426b31a45afbc448b8b01d3f4d09fb53b2f4f
Tags
modiloader trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a475322f26172f4dad7c67d1f01426b31a45afbc448b8b01d3f4d09fb53b2f4f

Threat Level: Known bad

The file 010017e186c37470c1208876f7bb2db3_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader trojan

ModiLoader, DBatLoader

ModiLoader Second Stage

Loads dropped DLL

Executes dropped EXE

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-19 22:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-19 22:54

Reported

2024-06-19 22:56

Platform

win7-20240611-en

Max time kernel

121s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\winow.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\winow.dll C:\Users\Admin\AppData\Local\Temp\010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe N/A
File created C:\Windows\winow.exe C:\Users\Admin\AppData\Local\Temp\010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winow.exe C:\Users\Admin\AppData\Local\Temp\010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe N/A
File created C:\Windows\winow.dll C:\Windows\winow.exe N/A
File created C:\Windows\winow.exe C:\Windows\winow.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2228 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe C:\Windows\winow.exe
PID 2228 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe C:\Windows\winow.exe
PID 2228 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe C:\Windows\winow.exe
PID 2228 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe C:\Windows\winow.exe

Processes

C:\Users\Admin\AppData\Local\Temp\010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe"

C:\Windows\winow.exe

C:\Windows\winow.exe

Network

N/A

Files

memory/2228-0-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2228-8-0x0000000000220000-0x0000000000245000-memory.dmp

C:\Windows\winow.exe

MD5 010017e186c37470c1208876f7bb2db3
SHA1 6ddcc3756f32e75d0e782b832860dc9595326874
SHA256 a475322f26172f4dad7c67d1f01426b31a45afbc448b8b01d3f4d09fb53b2f4f
SHA512 3e30f2aa73576f65470952c71676ee429c4142d0147478fa3a27201fd614834d1fb46eb60c3e5add1392502d33267c7bbed3602366c4d7f15209b29beb46ab42

memory/2228-7-0x0000000000220000-0x0000000000245000-memory.dmp

memory/3040-12-0x0000000000400000-0x0000000000425000-memory.dmp

C:\Windows\winow.dll

MD5 5e0e81a2ef1a5013e7e3593b165590a0
SHA1 a940fc1e724b61a86acdc232669f0a50775cd840
SHA256 c3fe5505e2c18a9aedf654906184bd21a0ee889908894ca824ec7a6945edcca1
SHA512 4d47dd00a716f0492ddbe0974ba2f906e9602cffec8da61789a5232918abe44216df250bdd1ddcc0b75a3f583520119e4bbf687dfdb116c4336b80921577aa9b

memory/2228-13-0x0000000000400000-0x0000000000425000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-19 22:54

Reported

2024-06-19 22:56

Platform

win10v2004-20240226-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\winow.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\winow.exe N/A
N/A N/A C:\Windows\winow.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\winow.exe C:\Users\Admin\AppData\Local\Temp\010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe N/A
File created C:\Windows\winow.dll C:\Windows\winow.exe N/A
File created C:\Windows\winow.exe C:\Windows\winow.exe N/A
File created C:\Windows\winow.dll C:\Users\Admin\AppData\Local\Temp\010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe N/A
File created C:\Windows\winow.exe C:\Users\Admin\AppData\Local\Temp\010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\winow.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1616 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe C:\Windows\winow.exe
PID 1616 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe C:\Windows\winow.exe
PID 1616 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe C:\Windows\winow.exe

Processes

C:\Users\Admin\AppData\Local\Temp\010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\010017e186c37470c1208876f7bb2db3_JaffaCakes118.exe"

C:\Windows\winow.exe

C:\Windows\winow.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4020 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 11.179.89.13.in-addr.arpa udp

Files

memory/1616-0-0x0000000000400000-0x0000000000425000-memory.dmp

C:\Windows\winow.exe

MD5 010017e186c37470c1208876f7bb2db3
SHA1 6ddcc3756f32e75d0e782b832860dc9595326874
SHA256 a475322f26172f4dad7c67d1f01426b31a45afbc448b8b01d3f4d09fb53b2f4f
SHA512 3e30f2aa73576f65470952c71676ee429c4142d0147478fa3a27201fd614834d1fb46eb60c3e5add1392502d33267c7bbed3602366c4d7f15209b29beb46ab42

C:\Windows\winow.dll

MD5 5e0e81a2ef1a5013e7e3593b165590a0
SHA1 a940fc1e724b61a86acdc232669f0a50775cd840
SHA256 c3fe5505e2c18a9aedf654906184bd21a0ee889908894ca824ec7a6945edcca1
SHA512 4d47dd00a716f0492ddbe0974ba2f906e9602cffec8da61789a5232918abe44216df250bdd1ddcc0b75a3f583520119e4bbf687dfdb116c4336b80921577aa9b

memory/2388-11-0x0000000000440000-0x000000000044E000-memory.dmp

memory/1616-14-0x0000000000400000-0x0000000000425000-memory.dmp

memory/2388-15-0x0000000000440000-0x000000000044E000-memory.dmp

memory/2388-17-0x0000000000400000-0x0000000000425000-memory.dmp