Analysis
- max time kernel
98s - max time network
99s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
18/09/2024, 07:29
General
- Target e89cd24e3ace7305ab0bf23ba3a67a1a_JaffaCakes118.exe
- Size 616KB
- Sample240918-jbee3ayhkd
- SHA256 e41c2bc2e075435e170f401605c923ad8af00c24484c761e1f47e3e77c64d6f7
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 3 IoCs
- Drops file in Program Files directory 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e89cd24e3ace7305ab0bf23ba3a67a1a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e89cd24e3ace7305ab0bf23ba3a67a1a_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 6642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4048 -ip 40481⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4048-0-0x0000000000400000-0x000000000055F000-memory.dmp
memory/4048-1-0x0000000000760000-0x00000000007B4000-memory.dmp
memory/4048-9-0x0000000002570000-0x0000000002571000-memory.dmp
memory/4048-11-0x00000000034D0000-0x0000000003582000-memory.dmp
memory/4048-10-0x0000000002500000-0x0000000002501000-memory.dmp
memory/4048-8-0x0000000002540000-0x0000000002541000-memory.dmp
memory/4048-7-0x0000000002550000-0x0000000002551000-memory.dmp
memory/4048-6-0x00000000024E0000-0x00000000024E1000-memory.dmp
memory/4048-5-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/4048-4-0x0000000002560000-0x0000000002561000-memory.dmp
memory/4048-3-0x0000000002510000-0x0000000002511000-memory.dmp
memory/4048-2-0x0000000002530000-0x0000000002531000-memory.dmp
memory/4048-12-0x00000000034D0000-0x0000000003582000-memory.dmp
memory/4048-13-0x00000000034E0000-0x00000000034E1000-memory.dmp
memory/4048-14-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/4048-15-0x00000000024D0000-0x00000000024D1000-memory.dmp
memory/4048-17-0x0000000000400000-0x000000000055F000-memory.dmp
memory/4048-19-0x00000000034D0000-0x0000000003582000-memory.dmp
memory/4048-18-0x0000000000760000-0x00000000007B4000-memory.dmp