Malware Analysis Report

2024-10-19 07:00

Sample ID 240620-tf3nkazfjp
Target 0788b1fdfc19097b57df85013eb68413_JaffaCakes118
SHA256 b2d5820b2d985b0c27b2a88545ff5b6c3fd8e3f5878c6456e20385921f0c9b79
Tags
modiloader trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b2d5820b2d985b0c27b2a88545ff5b6c3fd8e3f5878c6456e20385921f0c9b79

Threat Level: Known bad

The file 0788b1fdfc19097b57df85013eb68413_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader trojan

ModiLoader, DBatLoader

ModiLoader Second Stage

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-20 16:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 16:00

Reported

2024-06-20 16:03

Platform

win7-20240611-en

Max time kernel

120s

Max time network

121s

Command Line

C:\Windows\Explorer.EXE

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\tcpip.exe C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
File created C:\Windows\SysWOW64\vvvvvvvv.bat C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
File created C:\Windows\SysWOW64\winsystem.dll C:\Windows\SysWOW64\tcpip.exe N/A
File created C:\Windows\SysWOW64\tcpip.exe C:\Users\Admin\AppData\Local\Temp\temp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tcpip.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2028 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\0788b1fdfc19097b57df85013eb68413_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2028 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\0788b1fdfc19097b57df85013eb68413_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2028 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\0788b1fdfc19097b57df85013eb68413_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2028 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\0788b1fdfc19097b57df85013eb68413_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1664 wrote to memory of 1652 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\temp.exe
PID 1664 wrote to memory of 1652 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\temp.exe
PID 1664 wrote to memory of 1652 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\temp.exe
PID 1664 wrote to memory of 1652 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\temp.exe
PID 1652 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\temp.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 1128 N/A C:\Windows\SysWOW64\tcpip.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\0788b1fdfc19097b57df85013eb68413_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0788b1fdfc19097b57df85013eb68413_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\temp.exe

C:\Users\Admin\AppData\Local\Temp\temp.exe

C:\Users\Admin\AppData\Local\Temp\temp.exe

C:\Windows\SysWOW64\tcpip.exe

C:\Windows\SysWOW64\tcpip.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Windows\system32\vvvvvvvv.bat

Network

N/A

Files

memory/2028-0-0x0000000000400000-0x000000000042103E-memory.dmp

memory/2028-3-0x0000000000400000-0x000000000042103E-memory.dmp

C:\Users\Admin\AppData\Local\Temp\temp.exe

MD5 5cf0d713ad1965006e123532540fbc89
SHA1 493d724745be1560c45a317b8e6bbdeb30c09459
SHA256 3e1e5d9fcd47589ab77ad92a260fcbff8328aaba08ffc636591f5e88278465a9
SHA512 a0e27775fc71592e0925c2d2778eda1de9c955ddebebb7c0d981ff91b78a1be98268e11322beeaed0bf9314a9dcfe9bbd4a0711c12873e3f0bc0e8aad748d7d0

C:\Windows\SysWOW64\vvvvvvvv.bat

MD5 62d9458eb6f619c54437f7b0fbf61b4a
SHA1 2e0dad7bce2fd724d66f4f448207c106615672a1
SHA256 5fa2bcfd5ab256d593d88b4164d42bb80037957d1bfaf93761848cb2742d76a3
SHA512 8913fbb1a26c39fb785ff12df80a289ff0783f99892b0782153e64f0551b144e8fc0c52d110b1a8fbfce0802b8b7e45b89331f77ff3f676d210e7b192d45b449

memory/1128-19-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 16:00

Reported

2024-06-20 16:03

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

53s

Command Line

C:\Windows\Explorer.EXE

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\tcpip.exe C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
File opened for modification C:\Windows\SysWOW64\tcpip.exe C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
File created C:\Windows\SysWOW64\vvvvvvvv.bat C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
File created C:\Windows\SysWOW64\winsystem.dll C:\Windows\SysWOW64\tcpip.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0788b1fdfc19097b57df85013eb68413_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0788b1fdfc19097b57df85013eb68413_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0788b1fdfc19097b57df85013eb68413_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0788b1fdfc19097b57df85013eb68413_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A
N/A N/A C:\Windows\SysWOW64\tcpip.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\temp.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tcpip.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\0788b1fdfc19097b57df85013eb68413_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0788b1fdfc19097b57df85013eb68413_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\temp.exe

C:\Users\Admin\AppData\Local\Temp\temp.exe

C:\Users\Admin\AppData\Local\Temp\temp.exe

C:\Windows\SysWOW64\tcpip.exe

C:\Windows\SysWOW64\tcpip.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Windows\system32\vvvvvvvv.bat

Network

Files

memory/2156-0-0x0000000000400000-0x000000000042103E-memory.dmp

memory/2156-3-0x0000000000400000-0x000000000042103E-memory.dmp

C:\Users\Admin\AppData\Local\Temp\temp.exe

MD5 5cf0d713ad1965006e123532540fbc89
SHA1 493d724745be1560c45a317b8e6bbdeb30c09459
SHA256 3e1e5d9fcd47589ab77ad92a260fcbff8328aaba08ffc636591f5e88278465a9
SHA512 a0e27775fc71592e0925c2d2778eda1de9c955ddebebb7c0d981ff91b78a1be98268e11322beeaed0bf9314a9dcfe9bbd4a0711c12873e3f0bc0e8aad748d7d0

C:\Windows\SysWOW64\vvvvvvvv.bat

MD5 62d9458eb6f619c54437f7b0fbf61b4a
SHA1 2e0dad7bce2fd724d66f4f448207c106615672a1
SHA256 5fa2bcfd5ab256d593d88b4164d42bb80037957d1bfaf93761848cb2742d76a3
SHA512 8913fbb1a26c39fb785ff12df80a289ff0783f99892b0782153e64f0551b144e8fc0c52d110b1a8fbfce0802b8b7e45b89331f77ff3f676d210e7b192d45b449