Analysis
- max time kernel
51s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
25/06/2024, 10:33
General
- Target 0dbe9438e19b132ba2a24c804e557687_JaffaCakes118.exe
- Size 773KB
- Sample240625-mlkxdavarh
- SHA256 7d6a193fac792ce556743a9d2641610846f612d993ee9a0ab0a0635f2e9ff746
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 1 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dbe9438e19b132ba2a24c804e557687_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0dbe9438e19b132ba2a24c804e557687_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2264-0-0x0000000000400000-0x00000000004D3200-memory.dmp
memory/2264-2-0x0000000002290000-0x0000000002291000-memory.dmp
memory/2264-3-0x0000000000415000-0x0000000000416000-memory.dmp
memory/2264-4-0x0000000000400000-0x00000000004D3200-memory.dmp