Analysis
- max time kernel
94s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
07/12/2024, 08:00
General
- Target d166000940f80cfaf8198ed373146657_JaffaCakes118.exe
- Size 501KB
- Sample241207-jv697atkfy
- SHA256 df125d50864d4b5d90012e818d360ca50baa2bff4290814d83b80725105cc0b0
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Modiloader family
- ModiLoader Second Stage 2 IoCs
- Drops file in System32 directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d166000940f80cfaf8198ed373146657_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d166000940f80cfaf8198ed373146657_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3136-0-0x0000000000400000-0x00000000004D1000-memory.dmp
memory/3136-1-0x00000000022B0000-0x0000000002300000-memory.dmp
memory/3136-9-0x0000000002380000-0x0000000002381000-memory.dmp
memory/3136-11-0x0000000002D10000-0x0000000002D11000-memory.dmp
memory/3136-34-0x0000000002230000-0x0000000002231000-memory.dmp
memory/3136-37-0x0000000000400000-0x00000000004D1000-memory.dmp
memory/3136-36-0x00000000022B0000-0x0000000002300000-memory.dmp
memory/3136-33-0x0000000002D20000-0x0000000002D21000-memory.dmp
memory/3136-32-0x0000000002D30000-0x0000000002D31000-memory.dmp
memory/3136-31-0x0000000002D40000-0x0000000002D41000-memory.dmp
memory/3136-30-0x0000000002220000-0x0000000002221000-memory.dmp
memory/3136-29-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3136-28-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3136-27-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3136-26-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3136-25-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3136-24-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3136-23-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3136-22-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3136-21-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3136-20-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3136-19-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3136-18-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3136-17-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3136-16-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3136-15-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/3136-12-0x0000000002D50000-0x0000000002E50000-memory.dmp
memory/3136-10-0x0000000002D00000-0x0000000002D02000-memory.dmp
memory/3136-14-0x0000000002D50000-0x0000000002E50000-memory.dmp
memory/3136-6-0x00000000023B0000-0x00000000023B1000-memory.dmp
memory/3136-5-0x00000000023A0000-0x00000000023A1000-memory.dmp
memory/3136-4-0x0000000002350000-0x0000000002351000-memory.dmp
memory/3136-2-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/3136-8-0x00000000023C0000-0x00000000023C1000-memory.dmp
memory/3136-7-0x0000000002500000-0x0000000002501000-memory.dmp
memory/3136-3-0x0000000002370000-0x0000000002371000-memory.dmp