Analysis
- max time kernel
142s - max time network
49s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
01/07/2024, 19:46
General
- Target 1c474d76e1ef23f5f3c78b76851db8c1_JaffaCakes118.exe
- Size 2.1MB
- Sample240701-yg1mtazdlr
- SHA256 c9e44618ad3d8d1799a0f31445219df6c37bda0a8a26bf5c9b1ce5fcaf72f9e5
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 8 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c474d76e1ef23f5f3c78b76851db8c1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1c474d76e1ef23f5f3c78b76851db8c1_JaffaCakes118.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Operate.ini
memory/1460-37-0x000000007EB80000-0x000000007EC39000-memory.dmp
memory/1460-43-0x0000000000400000-0x0000000000946000-memory.dmp
memory/1460-35-0x0000000004D70000-0x0000000004D71000-memory.dmp
memory/1460-36-0x0000000000400000-0x0000000000946000-memory.dmp
memory/1460-39-0x000000007ECE0000-0x000000007EF5E000-memory.dmp
memory/1460-41-0x0000000077150000-0x0000000077179000-memory.dmp
memory/1460-40-0x000000007EF60000-0x000000007F03B000-memory.dmp
memory/1460-0-0x0000000000400000-0x0000000000946000-memory.dmp
memory/1460-1-0x0000000000C00000-0x0000000000C01000-memory.dmp
memory/1460-38-0x000000007EC40000-0x000000007ECDB000-memory.dmp
memory/1460-42-0x0000000000400000-0x0000000000946000-memory.dmp
memory/1460-49-0x0000000000C00000-0x0000000000C01000-memory.dmp
memory/1460-50-0x0000000004D70000-0x0000000004D71000-memory.dmp
memory/1460-51-0x0000000000400000-0x0000000000946000-memory.dmp
memory/1460-69-0x0000000000400000-0x0000000000946000-memory.dmp
memory/1460-75-0x0000000000400000-0x0000000000946000-memory.dmp
memory/1460-93-0x0000000000400000-0x0000000000946000-memory.dmp
memory/1460-99-0x0000000000400000-0x0000000000946000-memory.dmp