Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
20/06/2024, 08:31
General
- Target 045eba5c557f78f80f5bd0f1cb81a8cf_JaffaCakes118.exe
- Size 581KB
- Sample240620-keregaxhpc
- SHA256 5d42c938d43e8ee3b2065e64e28fd8b6fc9fd8ea32695a3cdae21c15fe7be34e
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 8 IoCs
- Executes dropped EXE 1 IoCs
- Drops file in Program Files directory 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\045eba5c557f78f80f5bd0f1cb81a8cf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\045eba5c557f78f80f5bd0f1cb81a8cf_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\MSINFO\svchost.bat"C:\Program Files\Common Files\Microsoft Shared\MSINFO\svchost.bat"2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\Common Files\Microsoft Shared\MSINFO\SxDel.bat""2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
SxDel.bat
svchost.bat
memory/1436-8-0x0000000002400000-0x0000000002401000-memory.dmp
memory/1436-4-0x0000000002420000-0x0000000002421000-memory.dmp
memory/1436-11-0x0000000003380000-0x000000000342C000-memory.dmp
memory/1436-9-0x0000000002430000-0x0000000002431000-memory.dmp
memory/1436-0-0x0000000000400000-0x0000000000550000-memory.dmp
memory/1436-7-0x0000000002410000-0x0000000002411000-memory.dmp
memory/1436-6-0x0000000002380000-0x0000000002381000-memory.dmp
memory/1436-2-0x00000000023F0000-0x00000000023F1000-memory.dmp
memory/1436-15-0x0000000002370000-0x0000000002371000-memory.dmp
memory/1436-3-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/1436-10-0x00000000023B0000-0x00000000023B1000-memory.dmp
memory/1436-14-0x0000000003380000-0x0000000003381000-memory.dmp
memory/1436-5-0x0000000002390000-0x0000000002391000-memory.dmp
memory/1436-22-0x00000000006D0000-0x0000000000724000-memory.dmp
memory/1436-21-0x0000000000400000-0x0000000000550000-memory.dmp
memory/1436-23-0x0000000003380000-0x0000000003386000-memory.dmp
memory/1436-1-0x00000000006D0000-0x0000000000724000-memory.dmp
memory/2396-25-0x0000000000400000-0x0000000000550000-memory.dmp
memory/2396-26-0x0000000000400000-0x0000000000550000-memory.dmp
memory/2396-31-0x0000000000400000-0x0000000000550000-memory.dmp
memory/2396-32-0x0000000000400000-0x0000000000550000-memory.dmp
memory/2396-37-0x0000000000400000-0x0000000000550000-memory.dmp
memory/2396-38-0x0000000000400000-0x0000000000550000-memory.dmp