Malware Analysis Report

2024-10-23 19:32

Sample ID 240620-x38pwatela
Target 0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118
SHA256 fd4fddbfca5fd959b445e1b0aa0f9b8e4364a815e12c084abfc46307925d3777
Tags
modiloader trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fd4fddbfca5fd959b445e1b0aa0f9b8e4364a815e12c084abfc46307925d3777

Threat Level: Known bad

The file 0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader trojan

ModiLoader, DBatLoader

ModiLoader Second Stage

Executes dropped EXE

Drops file in System32 directory

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-20 19:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 19:23

Reported

2024-06-20 19:26

Platform

win7-20240221-en

Max time kernel

120s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rascetrs.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\rascetrs.exe C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ncpxa.DLL C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\critrfs.sys C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\rascetrs.exe C:\Windows\SysWOW64\rascetrs.exe N/A
File created C:\Windows\SysWOW64\entarnoi.sys C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\critrfs.sys C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\natrnie.sys C:\Windows\SysWOW64\rascetrs.exe N/A
File opened for modification C:\Windows\SysWOW64\rascetrs.exe C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\natrnie.sys C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\nacktio.sys C:\Windows\SysWOW64\rascetrs.exe N/A
File created C:\Windows\SysWOW64\entarnoi.sys C:\Windows\SysWOW64\rascetrs.exe N/A
File opened for modification C:\Windows\SysWOW64\critrfs.sys C:\Windows\SysWOW64\rascetrs.exe N/A
File created C:\Windows\SysWOW64\nacktio.sys C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe"

C:\Windows\SysWOW64\rascetrs.exe

C:\Windows\SysWOW64\rascetrs.exe

Network

N/A

Files

C:\Windows\SysWOW64\rascetrs.exe

MD5 0911995cf1ba233e13a4958846f9a1c0
SHA1 055724f98727a5332bf1e6a2499a896a9e74ca2c
SHA256 fd4fddbfca5fd959b445e1b0aa0f9b8e4364a815e12c084abfc46307925d3777
SHA512 e344e0cafeecb6e44a407f34c7329ba739ecd62e90520b1802d2c7de2e65a1b5c11fc21547bb16043f171076994d1fa53566e753e31f49098d4f1a9fdc6e07d1

C:\Windows\SysWOW64\nacktio.sys

MD5 40d42be372aef4d98307061d3d84ac8f
SHA1 b322bdd0e12eee768393b5b407a11ff0e9d5f201
SHA256 91e2e5f74556bee5d0916532362e4101cd8bb6616dc1cdcc3cba5b0beb748bc6
SHA512 d611ef49b78c4b5a4ac168175b265825e6110cf150a098c5b7b07a2aa6a9c0b54e0f9aa367d5194fbaf6cf1f3d8a58a2581c3be473e48c6202be5730ad1f3092

C:\Windows\SysWOW64\natrnie.sys

MD5 1cd653f3b4ef4fdbe3498860167f1f08
SHA1 8aadddfdcb3bde2c46ae10130aa0536c2c481fa0
SHA256 95a370282b6c2dff5a626eb71e6fa4f4a1b7559c58ec34d3cbb44af4a57cffb3
SHA512 3fc59e2069e45ba80d670229b671c0523244847e5716e03ba89b7435738bd9c0caa40d4c6c2cf47c7afed232ddd41fcae559b1b1e378e4d192d7becd75f3be9b

C:\Windows\SysWOW64\entarnoi.sys

MD5 67799a6b4bde6110b9927271d6b03869
SHA1 c5b093354e87c5c769e803cc2351764733836d4d
SHA256 02f6f1255980ba4ef08a62f295dc74eeea9e4e5b317532411981fde301765fed
SHA512 2d73196e984075503f63a51478a3772aef92ef6888f7c6e8cbc3a5599c80076e107d7982c613ae77842c7da53ac2dbb3d5bef310d6004e61b226de6bcc840224

C:\Windows\SysWOW64\critrfs.sys

MD5 710bacf7059fef2c1f07fc1dcdaa5b95
SHA1 40b2093f31197dba7e9e28753973231f1016fbda
SHA256 7726f0169079fd83e0638143d72070803d6191a7888a9e54626fa9987fb108a9
SHA512 e5ec6dd3680b53b9cf86ecf6e20f70542c8b01f1f9679a2d1fa02dceefe1488ff1cfcb3e6402d054049bc11da3f4184454bdf01694f35db5657225cd690a93d4

memory/2052-23-0x0000000000400000-0x0000000000494000-memory.dmp

memory/756-24-0x0000000000400000-0x0000000000494000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 19:23

Reported

2024-06-20 19:26

Platform

win10v2004-20240611-en

Max time kernel

139s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0911995cf1ba233e13a4958846f9a1c0_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 98.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

N/A