Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
02/07/2024, 11:55
General
- Target 1f3e88612ee6e78e9f756a1c790dbb47_JaffaCakes118.exe
- Size 764KB
- Sample240702-n3ex5averr
- SHA256 311b87694428662147988c6a718f88dc42a4f40d1b1decbbb4ce71080d21e7e4
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 1 IoCs
- Drops file in System32 directory 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f3e88612ee6e78e9f756a1c790dbb47_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1f3e88612ee6e78e9f756a1c790dbb47_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 6362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4228 -ip 42281⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4228-1-0x00000000021C0000-0x0000000002214000-memory.dmp
memory/4228-0-0x0000000000400000-0x0000000000513000-memory.dmp
memory/4228-6-0x0000000002390000-0x0000000002391000-memory.dmp
memory/4228-5-0x00000000023A0000-0x00000000023A1000-memory.dmp
memory/4228-4-0x0000000002410000-0x0000000002411000-memory.dmp
memory/4228-3-0x00000000023C0000-0x00000000023C1000-memory.dmp
memory/4228-2-0x00000000023E0000-0x00000000023E1000-memory.dmp
memory/4228-10-0x00000000023B0000-0x00000000023B1000-memory.dmp
memory/4228-9-0x0000000002420000-0x0000000002421000-memory.dmp
memory/4228-8-0x00000000023F0000-0x00000000023F1000-memory.dmp
memory/4228-7-0x0000000002400000-0x0000000002401000-memory.dmp
memory/4228-11-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-12-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-14-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-17-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-16-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-15-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-20-0x0000000003480000-0x0000000003481000-memory.dmp
memory/4228-19-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-18-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-24-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-27-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-34-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-33-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-32-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-31-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-30-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-29-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-28-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-26-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-25-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-23-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-22-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-21-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-39-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-40-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-41-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-42-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-44-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-46-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-45-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-43-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-38-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-48-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-52-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-51-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-50-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-49-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-47-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-37-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-36-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-35-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-53-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-54-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-58-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-60-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-62-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-64-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-67-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-66-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-65-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-63-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-61-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-59-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-57-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-56-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-55-0x0000000003380000-0x0000000003480000-memory.dmp
memory/4228-68-0x0000000000400000-0x0000000000513000-memory.dmp
memory/4228-69-0x00000000021C0000-0x0000000002214000-memory.dmp