Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-11-2024 22:30
General
-
Target
8dcda57b85ec3154d986f68d5af49db5_JaffaCakes118.exe
-
Size
34KB
-
MD5
8dcda57b85ec3154d986f68d5af49db5
-
SHA1
c30d062e0da4f85ae28b826582a2073c7a9bfa75
-
SHA256
6a3db5adecfd0c030b7417573acdf7e564a689e51200485ab1ab7bce12c90a3b
-
SHA512
1d2314d773a3701d9b81216a2db98d304d10913f9c6df98df98d86e703a3848f41256aaa6b0e5df63da487ccb12e905a06300f62ad643486c1961916803a023c
-
SSDEEP
768:/qJCnrXKxzzfLGtm6BqCzk1gbiWrDlhpJPDSQpcNSZrduxjhH:/qMXGLaLIt1hWrDlhpJPqAUll
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 3 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8dcda57b85ec3154d986f68d5af49db5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8dcda57b85ec3154d986f68d5af49db5_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22KB
MD562f2cd67469b615b65fe010fe9956dc1
SHA128dbfb91b3498eb2a422caaf38b5ea03227f1dd3
SHA256bd696987155e3f4820b8623335d2efb78982d992730e454e9e3a896c7a968f9c
SHA512c0fde31d90df40fec55cb306e3256fa261d3010db607a6a91ae9ee0a774ddfdd6fe08205ae451b82e45d58fe7e13040238d4f9f52109cafbab9d73a62da92eff
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
144KB
-
Filesize
4KB
-
Filesize
112KB