Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-01-2025 23:53

General

  • Target

    JaffaCakes118_120e4df0c3b744955148c5cb537ba83c.exe

  • Size

    120KB

  • MD5

    120e4df0c3b744955148c5cb537ba83c

  • SHA1

    fa94e085eb5b429d6ece757b40f2c994f0f27b60

  • SHA256

    386cb73f22d568f84e070eced920637f774c221ee1e03732d35497d0082b5577

  • SHA512

    364dc439213a3ea944f370fbe79f8d523665dd6a3ed9831b71a48564ad3394b6594c0932874ac7bac49dd87031aa170beb419f51d935bdfa8ec56c4be6d93dcd

  • SSDEEP

    3072:Z3quyYSRimKjuonB5+UNaAats0Sk7UdFFO8Q4Aov//T:BbSRO/B5+Yatik7wFOgAov

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader Second Stage 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_120e4df0c3b744955148c5cb537ba83c.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_120e4df0c3b744955148c5cb537ba83c.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Users\Admin\AppData\Local\Temp\blade.exe
      "C:\Users\Admin\AppData\Local\Temp\blade.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1936
      • C:\Windows\apocalyps32.exe
        -bs
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2812
        • C:\Program Files\Internet Explorer\iexplore.exe
          -bs
          4⤵
            PID:2732

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\blade.exe

      Filesize

      98KB

      MD5

      4fca72a253e7724f96461c6a9201e911

      SHA1

      2254e9485c6cd4ec8b9bfff674722c42eec91c62

      SHA256

      89da40162e4b4a125adb6d41e0e7c7fbc6f002296bfa8117a63c5b185c15a40b

      SHA512

      821237eab23f7af79e8b35f83af0cef643bcda6c60bf0c04088ee2c0fda58d1e8772fa8645d9e57a215a984eaf3dde2b6b6911d5b72ce24a07ff4d4d66895dcc

    • memory/1936-24-0x0000000000010000-0x0000000000036000-memory.dmp

      Filesize

      152KB

    • memory/1936-33-0x0000000000010000-0x0000000000036000-memory.dmp

      Filesize

      152KB

    • memory/2248-20-0x0000000004860000-0x0000000004886000-memory.dmp

      Filesize

      152KB

    • memory/2248-14-0x0000000004860000-0x0000000004886000-memory.dmp

      Filesize

      152KB

    • memory/2248-21-0x0000000004080000-0x0000000004082000-memory.dmp

      Filesize

      8KB

    • memory/2248-23-0x00000000068F0000-0x0000000006916000-memory.dmp

      Filesize

      152KB

    • memory/2248-25-0x0000000004860000-0x0000000004886000-memory.dmp

      Filesize

      152KB

    • memory/2248-36-0x00000000068F0000-0x0000000006916000-memory.dmp

      Filesize

      152KB

    • memory/2248-34-0x0000000004860000-0x0000000004886000-memory.dmp

      Filesize

      152KB

    • memory/2248-40-0x00000000068F0000-0x0000000006916000-memory.dmp

      Filesize

      152KB

    • memory/2812-39-0x0000000000010000-0x0000000000036000-memory.dmp

      Filesize

      152KB