Overview

overview

10

Static

static

3

d465be5636...18.exe

windows7-x64

10

d465be5636...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    08/09/2024, 12:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d465be5636dd581a56640bb178e9141b_JaffaCakes118.exe

  • Size

    42KB

  • MD5

    d465be5636dd581a56640bb178e9141b

  • SHA1

    941651d11c5e5a068bfbd17b1cbd3cd7b940bc91

  • SHA256

    5ac26c2e08cbbf2b06408d522e86d72d624cd8d94c13bb63f9ef5d8c542fac74

  • SHA512

    c6a3ce611bd10a39e5d1e09a15e1fefdc70f096528a748c51e98b17f9a9e4b688aef83777d511b2e3ffed85c3ecf1435819cdc2eb6264fdbdf95a6943d5bb5ce

  • SSDEEP

    768:e0Rgqu4om2+4AlkWFT9abBmYgakquYZC8bUHC3ngKXaP36ghIR+AABarOYO:W4o/+4ARTQmYv9ZC8bfQ5IoAYw/O

Score
10/10
modiloadertrojan

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • ModiLoader Second Stage 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d465be5636dd581a56640bb178e9141b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d465be5636dd581a56640bb178e9141b_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1680-0-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1680-1-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

    Download