Malware Analysis Report

2024-10-23 19:32

Sample ID 240620-1wzeeatamm
Target 09a2ee117e757f3c5ff276c95b2d7a65_JaffaCakes118
SHA256 d20b49206b3a4b6f9afa9c404cd876d6effc04ee740b106e7537f1a411d2f076
Tags
modiloader trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d20b49206b3a4b6f9afa9c404cd876d6effc04ee740b106e7537f1a411d2f076

Threat Level: Known bad

The file 09a2ee117e757f3c5ff276c95b2d7a65_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader trojan

ModiLoader, DBatLoader

ModiLoader Second Stage

Loads dropped DLL

Deletes itself

Executes dropped EXE

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-20 22:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 22:00

Reported

2024-06-20 22:03

Platform

win7-20231129-en

Max time kernel

117s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\09a2ee117e757f3c5ff276c95b2d7a65_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ddos.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Deleteme.bat C:\Users\Admin\AppData\Local\Temp\09a2ee117e757f3c5ff276c95b2d7a65_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ddos.exe C:\Users\Admin\AppData\Local\Temp\09a2ee117e757f3c5ff276c95b2d7a65_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ddos.exe C:\Users\Admin\AppData\Local\Temp\09a2ee117e757f3c5ff276c95b2d7a65_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ddos.exe C:\Windows\SysWOW64\ddos.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\09a2ee117e757f3c5ff276c95b2d7a65_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\09a2ee117e757f3c5ff276c95b2d7a65_JaffaCakes118.exe"

C:\Windows\SysWOW64\ddos.exe

C:\Windows\system32\ddos.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Windows\system32\Deleteme.bat

Network

N/A

Files

memory/1960-0-0x0000000000400000-0x000000000048A99C-memory.dmp

memory/1960-1-0x000000000048A000-0x000000000048B000-memory.dmp

memory/1960-4-0x0000000000400000-0x000000000048A99C-memory.dmp

\Windows\SysWOW64\ddos.exe

MD5 09a2ee117e757f3c5ff276c95b2d7a65
SHA1 c6911fa8cec8ac155373a574779bb167c44ab747
SHA256 d20b49206b3a4b6f9afa9c404cd876d6effc04ee740b106e7537f1a411d2f076
SHA512 5a0faed6f0649e4cc9a314e84907b7fec36514c473fc46ea1e5d6c17ff120ef5035e9c37f6648465758f0679a5b855ca1f27c3d72e503585d9b4913dc21856f4

memory/1960-6-0x0000000001FB0000-0x000000000203B000-memory.dmp

memory/2528-14-0x0000000000400000-0x000000000048A99C-memory.dmp

memory/2528-13-0x0000000000400000-0x000000000048A99C-memory.dmp

memory/2528-16-0x0000000000400000-0x000000000048A99C-memory.dmp

C:\Windows\SysWOW64\Deleteme.bat

MD5 ea9cc2a84fa963c1cd3118bdb6a9b66c
SHA1 c94d63cecf1b13df6b00f065ef5145edba697c26
SHA256 e7c0213b9a5aa2d9934db72d5a0068627c5eaec0f691cfbac11e4077814a3e1c
SHA512 ad45bd30ff75521ee6455fea6c4d30e603c69c37497336af8e9b87f160eb201a3592676c7753164bc1caf20614094d3a1d86c6d8068024b749d2f79a695cf408

memory/2528-18-0x0000000000400000-0x000000000048A99C-memory.dmp

memory/1960-25-0x0000000000400000-0x000000000048A99C-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 22:00

Reported

2024-06-20 22:03

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\09a2ee117e757f3c5ff276c95b2d7a65_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ddos.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\ddos.exe C:\Users\Admin\AppData\Local\Temp\09a2ee117e757f3c5ff276c95b2d7a65_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ddos.exe C:\Users\Admin\AppData\Local\Temp\09a2ee117e757f3c5ff276c95b2d7a65_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ddos.exe C:\Windows\SysWOW64\ddos.exe N/A
File created C:\Windows\SysWOW64\Deleteme.bat C:\Users\Admin\AppData\Local\Temp\09a2ee117e757f3c5ff276c95b2d7a65_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\09a2ee117e757f3c5ff276c95b2d7a65_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\09a2ee117e757f3c5ff276c95b2d7a65_JaffaCakes118.exe"

C:\Windows\SysWOW64\ddos.exe

C:\Windows\system32\ddos.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

memory/1360-0-0x0000000000400000-0x000000000048A99C-memory.dmp

memory/1360-1-0x000000000048A000-0x000000000048B000-memory.dmp

memory/1360-2-0x0000000000400000-0x000000000048A99C-memory.dmp

C:\Windows\SysWOW64\ddos.exe

MD5 09a2ee117e757f3c5ff276c95b2d7a65
SHA1 c6911fa8cec8ac155373a574779bb167c44ab747
SHA256 d20b49206b3a4b6f9afa9c404cd876d6effc04ee740b106e7537f1a411d2f076
SHA512 5a0faed6f0649e4cc9a314e84907b7fec36514c473fc46ea1e5d6c17ff120ef5035e9c37f6648465758f0679a5b855ca1f27c3d72e503585d9b4913dc21856f4

memory/3644-8-0x0000000000400000-0x000000000048A99C-memory.dmp

memory/3644-9-0x0000000000400000-0x000000000048A99C-memory.dmp

memory/3644-12-0x0000000000400000-0x000000000048A99C-memory.dmp

memory/1360-13-0x0000000000400000-0x000000000048A99C-memory.dmp

C:\Windows\SysWOW64\Deleteme.bat

MD5 ea9cc2a84fa963c1cd3118bdb6a9b66c
SHA1 c94d63cecf1b13df6b00f065ef5145edba697c26
SHA256 e7c0213b9a5aa2d9934db72d5a0068627c5eaec0f691cfbac11e4077814a3e1c
SHA512 ad45bd30ff75521ee6455fea6c4d30e603c69c37497336af8e9b87f160eb201a3592676c7753164bc1caf20614094d3a1d86c6d8068024b749d2f79a695cf408