Analysis

  • max time kernel
    16s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    15/01/2025, 13:50 UTC

General

  • Target

    JaffaCakes118_58a6b7936f77edd249d96a4f66773eb3.exe

  • Size

    641KB

  • MD5

    58a6b7936f77edd249d96a4f66773eb3

  • SHA1

    59cf3e90ce1cd132b5e8bd133640c0d48a4de730

  • SHA256

    205154024fb9ad6f526f58b048871fe35a80e48aaccf36fb9c83e1e9450bc13e

  • SHA512

    375330eb88298e7942619a21027ee760388fd062b847317e1a562259874e5e30871c28746b4c7551cfd4e3817da3a8c02bd50b3b30609c756eae9a1d8147176f

  • SSDEEP

    12288:0ZT2HoQqB80SvFeuEMN1c2obY7tXE6VA8ZHjp:0hSojB80SvFeXMpocZXEB6Hjp

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_58a6b7936f77edd249d96a4f66773eb3.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_58a6b7936f77edd249d96a4f66773eb3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Windows\SysWOW64\mstsc.exe
      "C:\Windows\system32\mstsc.exe"
      2⤵
        PID:2756

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2216-7-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

      Filesize

      4KB

    • memory/2216-0-0x0000000000400000-0x0000000000575000-memory.dmp

      Filesize

      1.5MB

    • memory/2216-2-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

      Filesize

      4KB

    • memory/2216-14-0x0000000002B30000-0x0000000002B31000-memory.dmp

      Filesize

      4KB

    • memory/2216-13-0x0000000002B30000-0x0000000002B31000-memory.dmp

      Filesize

      4KB

    • memory/2216-12-0x0000000002B30000-0x0000000002B31000-memory.dmp

      Filesize

      4KB

    • memory/2216-11-0x0000000002B30000-0x0000000002B31000-memory.dmp

      Filesize

      4KB

    • memory/2216-10-0x0000000002B30000-0x0000000002B31000-memory.dmp

      Filesize

      4KB

    • memory/2216-8-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

      Filesize

      4KB

    • memory/2216-9-0x00000000003F0000-0x00000000003F1000-memory.dmp

      Filesize

      4KB

    • memory/2216-5-0x0000000001F90000-0x0000000001F91000-memory.dmp

      Filesize

      4KB

    • memory/2216-6-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

      Filesize

      4KB

    • memory/2216-1-0x0000000000320000-0x0000000000370000-memory.dmp

      Filesize

      320KB

    • memory/2216-4-0x00000000003D0000-0x00000000003D1000-memory.dmp

      Filesize

      4KB

    • memory/2216-3-0x00000000003E0000-0x00000000003E1000-memory.dmp

      Filesize

      4KB

    • memory/2216-21-0x0000000000400000-0x0000000000575000-memory.dmp

      Filesize

      1.5MB

    • memory/2216-22-0x0000000000320000-0x0000000000370000-memory.dmp

      Filesize

      320KB

    • memory/2756-17-0x0000000000400000-0x0000000000575000-memory.dmp

      Filesize

      1.5MB

    • memory/2756-19-0x0000000000400000-0x0000000000575000-memory.dmp

      Filesize

      1.5MB

    • memory/2756-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.