Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 04:18
Static task
static1
Behavioral task
behavioral1
Sample
249adc52f3d430a2605daab25fb88b20_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
249adc52f3d430a2605daab25fb88b20_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
249adc52f3d430a2605daab25fb88b20_JaffaCakes118.exe
-
Size
136KB
-
MD5
249adc52f3d430a2605daab25fb88b20
-
SHA1
2a650102c7e12f58da7182c0f0bec6ed6db69047
-
SHA256
d8708cc87463255017d70881f5c0cd4ca63ba1d7c054125dde984c04e97f84ca
-
SHA512
1bdee6b48b67fa20c13d24cb287fb5dfe50c6117b3dfd11130a085a669f934334e9b788c780a49002d7a53d602cea016185993981d0e89b2d1a4b8e8724cb314
-
SSDEEP
3072:s7Ac+dHNyAw0jH2uFhJTEDHsZ/lGK/Br9tf:q5+TBH1hJgDMZd
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
resource yara_rule behavioral1/memory/3064-10-0x0000000000010000-0x000000000003E000-memory.dmp modiloader_stage2 behavioral1/memory/2956-7-0x0000000000010000-0x000000000003E000-memory.dmp modiloader_stage2 behavioral1/memory/3064-12-0x0000000000010000-0x000000000003E000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 3064 apocalyps32.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\apocalyps32.exe apocalyps32.exe File created C:\Windows\apocalyps32.exe 249adc52f3d430a2605daab25fb88b20_JaffaCakes118.exe File opened for modification C:\Windows\apocalyps32.exe 249adc52f3d430a2605daab25fb88b20_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2956 wrote to memory of 3064 2956 249adc52f3d430a2605daab25fb88b20_JaffaCakes118.exe 28 PID 2956 wrote to memory of 3064 2956 249adc52f3d430a2605daab25fb88b20_JaffaCakes118.exe 28 PID 2956 wrote to memory of 3064 2956 249adc52f3d430a2605daab25fb88b20_JaffaCakes118.exe 28 PID 2956 wrote to memory of 3064 2956 249adc52f3d430a2605daab25fb88b20_JaffaCakes118.exe 28 PID 3064 wrote to memory of 1672 3064 apocalyps32.exe 29 PID 3064 wrote to memory of 1672 3064 apocalyps32.exe 29 PID 3064 wrote to memory of 1672 3064 apocalyps32.exe 29 PID 3064 wrote to memory of 1672 3064 apocalyps32.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\249adc52f3d430a2605daab25fb88b20_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\249adc52f3d430a2605daab25fb88b20_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\apocalyps32.exe-bs2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Program Files\Internet Explorer\iexplore.exe-bs3⤵PID:1672
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD5249adc52f3d430a2605daab25fb88b20
SHA12a650102c7e12f58da7182c0f0bec6ed6db69047
SHA256d8708cc87463255017d70881f5c0cd4ca63ba1d7c054125dde984c04e97f84ca
SHA5121bdee6b48b67fa20c13d24cb287fb5dfe50c6117b3dfd11130a085a669f934334e9b788c780a49002d7a53d602cea016185993981d0e89b2d1a4b8e8724cb314