Analysis

  • max time kernel
    94s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-09-2024 22:50

General

  • Target

    f702a220baa9e63faecaf918d107585a_JaffaCakes118.exe

  • Size

    108KB

  • MD5

    f702a220baa9e63faecaf918d107585a

  • SHA1

    b5a40712c417e50f52ae03214714ebc8d294cafe

  • SHA256

    bc4d8b347a155e1266689b377adfb72d927afaf68b8832dd8921ed4ccfb2f233

  • SHA512

    bd189f2e6a2d582a029ca8cfc753861bea23c1dcfaad01395ab4692b27858f5e92e0a5c908203f0e9579ca6f64e9cd75d42b55adc19959e9ae11191fe9017aad

  • SSDEEP

    3072:7oy8j7VnNdrPnaSekwi+mW+2Bp5cP/Aout:78jZ7rPaU3+mWrDpoS

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f702a220baa9e63faecaf918d107585a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f702a220baa9e63faecaf918d107585a_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2040
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 488
      2⤵
      • Program crash
      PID:5012
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2040 -ip 2040
    1⤵
      PID:1540

    Network

    • flag-us
      DNS
      58.55.71.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.55.71.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      20.160.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      20.160.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      232.168.11.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      232.168.11.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      183.59.114.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      183.59.114.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      110.11.19.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      110.11.19.2.in-addr.arpa
      IN PTR
      Response
      110.11.19.2.in-addr.arpa
      IN PTR
      a2-19-11-110deploystaticakamaitechnologiescom
    • flag-us
      DNS
      66.209.201.84.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      66.209.201.84.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      101.209.201.84.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      101.209.201.84.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      43.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.229.111.52.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      58.55.71.13.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      58.55.71.13.in-addr.arpa

    • 8.8.8.8:53
      20.160.190.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      20.160.190.20.in-addr.arpa

    • 8.8.8.8:53
      232.168.11.51.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      232.168.11.51.in-addr.arpa

    • 8.8.8.8:53
      183.59.114.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      183.59.114.20.in-addr.arpa

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      110.11.19.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      110.11.19.2.in-addr.arpa

    • 8.8.8.8:53
      66.209.201.84.in-addr.arpa
      dns
      72 B
      132 B
      1
      1

      DNS Request

      66.209.201.84.in-addr.arpa

    • 8.8.8.8:53
      101.209.201.84.in-addr.arpa
      dns
      73 B
      133 B
      1
      1

      DNS Request

      101.209.201.84.in-addr.arpa

    • 8.8.8.8:53
      43.229.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      43.229.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2040-0-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/2040-1-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.