Analysis
- max time kernel
51s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
21/06/2024, 12:13
General
- Target 0b5ac1980ede9f0dcacc0e5edcc64968_JaffaCakes118.exe
- Size 667KB
- Sample240621-pdrq3aygrd
- SHA256 ef5a2d8eae4dbef64a12e0d11b132a1b5c65872efa227d7b4408b2bf531321e9
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 5 IoCs
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in System32 directory 8 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b5ac1980ede9f0dcacc0e5edcc64968_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0b5ac1980ede9f0dcacc0e5edcc64968_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchst.exeC:\Windows\system32\svchst.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\DaverDel.bat3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchst.exeC:\Windows\system32\svchst.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\DaverDel.bat3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DaverDel.bat
svchst.exe
memory/1404-48-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/2964-88-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/3320-52-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/3900-81-0x0000000000400000-0x00000000004B3000-memory.dmp
memory/4008-60-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-50-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-58-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-20-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-33-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-47-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-91-0x0000000000560000-0x00000000005B4000-memory.dmp
memory/4008-90-0x0000000001000000-0x0000000001107000-memory.dmp
memory/4008-87-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-86-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-85-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-80-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-79-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-78-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-77-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-76-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-75-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-74-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-73-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-71-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-70-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-69-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-68-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-67-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-66-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-65-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-64-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-63-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-62-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-61-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-0-0x0000000001000000-0x0000000001107000-memory.dmp
memory/4008-59-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-19-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-11-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-40-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-46-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-45-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-44-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-43-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-42-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-41-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-1-0x0000000000560000-0x00000000005B4000-memory.dmp
memory/4008-39-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-38-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-37-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-36-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-35-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-34-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-32-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-31-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-18-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-17-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-16-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-15-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-14-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-13-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-12-0x0000000003100000-0x000000000311B000-memory.dmp
memory/4008-10-0x0000000000C20000-0x0000000000C21000-memory.dmp
memory/4008-9-0x0000000000C90000-0x0000000000C91000-memory.dmp
memory/4008-8-0x0000000000C60000-0x0000000000C61000-memory.dmp
memory/4008-7-0x0000000000C70000-0x0000000000C71000-memory.dmp
memory/4008-6-0x0000000000C00000-0x0000000000C01000-memory.dmp
memory/4008-5-0x0000000000C10000-0x0000000000C11000-memory.dmp
memory/4008-4-0x0000000000C80000-0x0000000000C81000-memory.dmp
memory/4008-3-0x0000000000C30000-0x0000000000C31000-memory.dmp
memory/4008-2-0x0000000000C50000-0x0000000000C51000-memory.dmp