Analysis

  • max time kernel
    140s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/09/2024, 19:11 UTC

General

  • Target

    e0d9988c37f32695298799287b4b0fc8_JaffaCakes118.exe

  • Size

    699KB

  • MD5

    e0d9988c37f32695298799287b4b0fc8

  • SHA1

    513355d0abf1da5cee43f2b54f6f3025f0d6067d

  • SHA256

    59c824c29eb7049744c4475b2b1d1c5f55b9ce3979d6a903fb0fbf68e9df82a7

  • SHA512

    c81376edae67b460fe7e61a31a70828d3862c4603d9e588cdfb38542e5f82468e33a3561d5c390060983479a9463428ba1d231e86deb79e9d7561849679981e5

  • SSDEEP

    12288:dc//////CHkdPLQ/oV6a1xEUQ4IfV8k9YGhGV3mhVWUY2TD9MAX+hmXhVIr0U:dc//////CEdDyaDm4dahGV3Qko1MAX+j

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 11 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e0d9988c37f32695298799287b4b0fc8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e0d9988c37f32695298799287b4b0fc8_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2272
    • C:\Users\Admin\AppData\Local\Temp\e0d9988c37f32695298799287b4b0fc8_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\e0d9988c37f32695298799287b4b0fc8_JaffaCakes118.exe
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2688

Network

  • flag-us
    DNS
    huayishuang2.3322.org
    e0d9988c37f32695298799287b4b0fc8_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    huayishuang2.3322.org
    IN A
    Response
No results found
  • 8.8.8.8:53
    huayishuang2.3322.org
    dns
    e0d9988c37f32695298799287b4b0fc8_JaffaCakes118.exe
    67 B
    131 B
    1
    1

    DNS Request

    huayishuang2.3322.org

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2272-5-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/2688-0-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2688-7-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2688-8-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2688-6-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2688-4-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2688-2-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2688-9-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2688-10-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2688-11-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2688-12-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2688-19-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2688-20-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2688-27-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.