Analysis
-
max time kernel
92s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-01-2025 11:32
Behavioral task
behavioral1
Sample
JaffaCakes118_6c4fa6ef4b5f4a9161c5696b13735420.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6c4fa6ef4b5f4a9161c5696b13735420.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_6c4fa6ef4b5f4a9161c5696b13735420.exe
-
Size
98KB
-
MD5
6c4fa6ef4b5f4a9161c5696b13735420
-
SHA1
2131a1714db4871d4507997407e62bee2a3e18e5
-
SHA256
dfcf6a0742e2efdfc52102a471e5b605e9bc663317b3b631f3422808389d714c
-
SHA512
7cf7fc93bec18e556d2462d39bc6654270282347f581b6313011cf2375bc2e88ef3d95919e1951579cdf4a758232108ab9c0c664e46b1fab8e2e96fbaa2badbd
-
SSDEEP
3072:q3qudXtBAsJDPC8hfw6nISGs6qZLFkaSye7MkPCoH:K9tB3DF1paqZLFk55IkPD
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral2/memory/3708-6-0x0000000000010000-0x0000000000036000-memory.dmp modiloader_stage2 behavioral2/memory/2340-7-0x0000000000010000-0x0000000000036000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 2340 apocalyps32.exe -
resource yara_rule behavioral2/memory/3708-0-0x0000000000010000-0x0000000000036000-memory.dmp upx behavioral2/files/0x000c000000023c49-3.dat upx behavioral2/memory/3708-6-0x0000000000010000-0x0000000000036000-memory.dmp upx behavioral2/memory/2340-7-0x0000000000010000-0x0000000000036000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\apocalyps32.exe JaffaCakes118_6c4fa6ef4b5f4a9161c5696b13735420.exe File opened for modification C:\Windows\apocalyps32.exe JaffaCakes118_6c4fa6ef4b5f4a9161c5696b13735420.exe File created C:\Windows\apocalyps32.exe apocalyps32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6c4fa6ef4b5f4a9161c5696b13735420.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apocalyps32.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3708 wrote to memory of 2340 3708 JaffaCakes118_6c4fa6ef4b5f4a9161c5696b13735420.exe 83 PID 3708 wrote to memory of 2340 3708 JaffaCakes118_6c4fa6ef4b5f4a9161c5696b13735420.exe 83 PID 3708 wrote to memory of 2340 3708 JaffaCakes118_6c4fa6ef4b5f4a9161c5696b13735420.exe 83 PID 2340 wrote to memory of 3352 2340 apocalyps32.exe 84 PID 2340 wrote to memory of 3352 2340 apocalyps32.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c4fa6ef4b5f4a9161c5696b13735420.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c4fa6ef4b5f4a9161c5696b13735420.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\apocalyps32.exe-bs2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe-bs3⤵PID:3352
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD56c4fa6ef4b5f4a9161c5696b13735420
SHA12131a1714db4871d4507997407e62bee2a3e18e5
SHA256dfcf6a0742e2efdfc52102a471e5b605e9bc663317b3b631f3422808389d714c
SHA5127cf7fc93bec18e556d2462d39bc6654270282347f581b6313011cf2375bc2e88ef3d95919e1951579cdf4a758232108ab9c0c664e46b1fab8e2e96fbaa2badbd