Analysis
- max time kernel
149s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
19/09/2026, 08:37
General
- Target jaffacakes118__854383b2aba6d692c1974faa0aec8f26.exe
- Size 412KB
- Sample260919-kjmxvaytey
- SHA256 21c1a83f458fdc87d342e597f456ce1cefbe83bb56bb4eb1bd7a1614f7fd9d4a
Malware Config
Signatures
- Family: ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__854383b2aba6d692c1974faa0aec8f26.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__854383b2aba6d692c1974faa0aec8f26.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dev-point.com4 .exe"C:\Users\Admin\AppData\Local\Temp\dev-point.com4 .exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dev-point.com4 .exe"C:\Users\Admin\AppData\Local\Temp\dev-point.com4 .exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dev-point.com4 .exe
memory/944-68-0x0000000000400000-0x0000000000408960-memory.dmp
memory/944-66-0x0000000000400000-0x0000000000409000-memory.dmp
memory/944-55-0x0000000000400000-0x0000000000409000-memory.dmp
memory/944-58-0x0000000000400000-0x0000000000409000-memory.dmp
memory/944-57-0x0000000000400000-0x0000000000408960-memory.dmp
memory/1080-13-0x0000000000400000-0x000000000046E000-memory.dmp
memory/3296-62-0x000000007FFF0000-0x000000007FFF7000-memory.dmp
memory/4740-36-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/4740-46-0x0000000002FA0000-0x0000000002FA1000-memory.dmp
memory/4740-26-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/4740-25-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/4740-24-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/4740-23-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/4740-22-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/4740-21-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/4740-20-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/4740-19-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/4740-18-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/4740-17-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/4740-16-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/4740-15-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/4740-14-0x0000000002220000-0x0000000002223000-memory.dmp
memory/4740-34-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4740-28-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/4740-35-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/4740-39-0x0000000002210000-0x0000000002211000-memory.dmp
memory/4740-38-0x0000000000650000-0x0000000000651000-memory.dmp
memory/4740-43-0x0000000000630000-0x0000000000631000-memory.dmp
memory/4740-27-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/4740-45-0x0000000002FB0000-0x0000000002FB1000-memory.dmp
memory/4740-44-0x0000000002240000-0x0000000002241000-memory.dmp
memory/4740-42-0x0000000000620000-0x0000000000621000-memory.dmp
memory/4740-41-0x0000000002230000-0x0000000002231000-memory.dmp
memory/4740-48-0x0000000002FC0000-0x0000000002FC1000-memory.dmp
memory/4740-54-0x0000000003030000-0x0000000003031000-memory.dmp
memory/4740-53-0x0000000003040000-0x0000000003041000-memory.dmp
memory/4740-52-0x0000000003010000-0x0000000003011000-memory.dmp
memory/4740-51-0x0000000003020000-0x0000000003021000-memory.dmp
memory/4740-50-0x0000000002FE0000-0x0000000002FE1000-memory.dmp
memory/4740-49-0x0000000003000000-0x0000000003001000-memory.dmp
memory/4740-47-0x0000000002FD0000-0x0000000002FD1000-memory.dmp
memory/4740-29-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/4740-30-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/4740-31-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/4740-60-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4740-32-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/4740-33-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/4740-12-0x0000000000400000-0x00000000004CD000-memory.dmp