Overview

overview

10

Static

static

10

e50b9d9c95...18.exe

windows7-x64

10

e50b9d9c95...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-09-2024 15:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e50b9d9c95b1113c090833e0a1168313_JaffaCakes118.exe

  • Size

    210KB

  • MD5

    e50b9d9c95b1113c090833e0a1168313

  • SHA1

    6a44f1b194751ea3b0e0244da0ead77ceedf395e

  • SHA256

    0b84bfe5b16de539670eed38b1f872e8cf8eb5e793a7e60e1b9e5cc17ed39c33

  • SHA512

    41a8dab05308123dfde3085c4109710437c574f0693fa7a33218453165f6134fa51fd54d0ba1a0d936df6cb2f8d632cffffc6a2c3dda2c9e0a7b23cf50353cd2

  • SSDEEP

    3072:3+xuxRFUAooV7Kh+Psz2U8pQDOdmegdhf9+91uhvTGiCeDgL90XYkG3RK3Ny6:uYJoBh4AwpCFEKa7kGhKdy6

Score
10/10
modiloadertrojan

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • ModiLoader Second Stage 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e50b9d9c95b1113c090833e0a1168313_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e50b9d9c95b1113c090833e0a1168313_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    PID:2480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2480-0-0x0000000010000000-0x000000001003A000-memory.dmp

    Filesize

    232KB

    Download