Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 19:23

General

  • Target

    0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe

  • Size

    178KB

  • MD5

    0911995cf1ba233e13a4958846f9a1c0

  • SHA1

    055724f98727a5332bf1e6a2499a896a9e74ca2c

  • SHA256

    fd4fddbfca5fd959b445e1b0aa0f9b8e4364a815e12c084abfc46307925d3777

  • SHA512

    e344e0cafeecb6e44a407f34c7329ba739ecd62e90520b1802d2c7de2e65a1b5c11fc21547bb16043f171076994d1fa53566e753e31f49098d4f1a9fdc6e07d1

  • SSDEEP

    3072:KWqiyhc/IcXbJSGOuQwwixlxTJ4Y3R6iXcK0ImNZJ2iECIfeJ0LuCMd8l5pO/YP:whcxbQDbw/j4lImNZJ2TCQ6+uC15pOM

Score
10/10

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    PID:756
  • C:\Windows\SysWOW64\rascetrs.exe
    C:\Windows\SysWOW64\rascetrs.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:2052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\critrfs.sys

    Filesize

    10B

    MD5

    710bacf7059fef2c1f07fc1dcdaa5b95

    SHA1

    40b2093f31197dba7e9e28753973231f1016fbda

    SHA256

    7726f0169079fd83e0638143d72070803d6191a7888a9e54626fa9987fb108a9

    SHA512

    e5ec6dd3680b53b9cf86ecf6e20f70542c8b01f1f9679a2d1fa02dceefe1488ff1cfcb3e6402d054049bc11da3f4184454bdf01694f35db5657225cd690a93d4

  • C:\Windows\SysWOW64\entarnoi.sys

    Filesize

    26B

    MD5

    67799a6b4bde6110b9927271d6b03869

    SHA1

    c5b093354e87c5c769e803cc2351764733836d4d

    SHA256

    02f6f1255980ba4ef08a62f295dc74eeea9e4e5b317532411981fde301765fed

    SHA512

    2d73196e984075503f63a51478a3772aef92ef6888f7c6e8cbc3a5599c80076e107d7982c613ae77842c7da53ac2dbb3d5bef310d6004e61b226de6bcc840224

  • C:\Windows\SysWOW64\nacktio.sys

    Filesize

    15B

    MD5

    40d42be372aef4d98307061d3d84ac8f

    SHA1

    b322bdd0e12eee768393b5b407a11ff0e9d5f201

    SHA256

    91e2e5f74556bee5d0916532362e4101cd8bb6616dc1cdcc3cba5b0beb748bc6

    SHA512

    d611ef49b78c4b5a4ac168175b265825e6110cf150a098c5b7b07a2aa6a9c0b54e0f9aa367d5194fbaf6cf1f3d8a58a2581c3be473e48c6202be5730ad1f3092

  • C:\Windows\SysWOW64\natrnie.sys

    Filesize

    8B

    MD5

    1cd653f3b4ef4fdbe3498860167f1f08

    SHA1

    8aadddfdcb3bde2c46ae10130aa0536c2c481fa0

    SHA256

    95a370282b6c2dff5a626eb71e6fa4f4a1b7559c58ec34d3cbb44af4a57cffb3

    SHA512

    3fc59e2069e45ba80d670229b671c0523244847e5716e03ba89b7435738bd9c0caa40d4c6c2cf47c7afed232ddd41fcae559b1b1e378e4d192d7becd75f3be9b

  • C:\Windows\SysWOW64\rascetrs.exe

    Filesize

    178KB

    MD5

    0911995cf1ba233e13a4958846f9a1c0

    SHA1

    055724f98727a5332bf1e6a2499a896a9e74ca2c

    SHA256

    fd4fddbfca5fd959b445e1b0aa0f9b8e4364a815e12c084abfc46307925d3777

    SHA512

    e344e0cafeecb6e44a407f34c7329ba739ecd62e90520b1802d2c7de2e65a1b5c11fc21547bb16043f171076994d1fa53566e753e31f49098d4f1a9fdc6e07d1

  • memory/756-24-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB

  • memory/2052-23-0x0000000000400000-0x0000000000494000-memory.dmp

    Filesize

    592KB