Analysis
-
max time kernel
141s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
01-07-2024 20:24
General
-
Target
1c616bd493458c1e6b54cb7873fcc3b5_JaffaCakes118.exe
-
Size
24KB
-
MD5
1c616bd493458c1e6b54cb7873fcc3b5
-
SHA1
c8a2af66ac3e9aee2f2ef042225147282403d715
-
SHA256
b00de540db8b452c1fea131cfb376f9fdd7c130c7e3e9fed249a4fb8950f3f02
-
SHA512
24154ebd1eea66ed1dffb33e6b407cafa9477b8d82034b3bf4c5bdeaf761ff53dd285ff659cd0b917048381f8122558874a8f8936c8c23f7b93850d95d6298f3
-
SSDEEP
384:a3pJzu/RQ+mLyvXYu5+z0M2o+6UWrokrOhE+D/lCeTl0LqJ3o:SupC2/kJ2YUWrEh3mio
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Windows directory 5 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c616bd493458c1e6b54cb7873fcc3b5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1c616bd493458c1e6b54cb7873fcc3b5_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\kulionzx.exeC:\Windows\kulionzx.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD59bf980b69cd4efed2b97d0c17e076336
SHA1843f422e397808abf689654aefa2653bb5343595
SHA25647efd4f96e6aa199ca0aaab87a712b1e2553360d342d55cb68ff280acaf955c2
SHA512e93f6d94c67aaf639b5665a69937e07654205055a4142cfc45a2e4f68f71b6f9b3a3ddd01a2b7e5602c803f9fd589937688b0dd937dcdbd238facdf8dd41bd25
-
Filesize
24KB
MD51c616bd493458c1e6b54cb7873fcc3b5
SHA1c8a2af66ac3e9aee2f2ef042225147282403d715
SHA256b00de540db8b452c1fea131cfb376f9fdd7c130c7e3e9fed249a4fb8950f3f02
SHA51224154ebd1eea66ed1dffb33e6b407cafa9477b8d82034b3bf4c5bdeaf761ff53dd285ff659cd0b917048381f8122558874a8f8936c8c23f7b93850d95d6298f3
-
Filesize
52KB
-
Filesize
136KB
-
Filesize
52KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB