Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 01:36
General
- Target jaffacakes118_ba5659d9ff07a71303d3cd354ab82f3edee17d5ffe38437b908f8aac4f416371.exe
- Size 270KB
- Sample260924-b1laxabd45
- SHA256 ba5659d9ff07a71303d3cd354ab82f3edee17d5ffe38437b908f8aac4f416371
Malware Config
Signatures
- Family: ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 23 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 4 IoCs
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ba5659d9ff07a71303d3cd354ab82f3edee17d5ffe38437b908f8aac4f416371.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ba5659d9ff07a71303d3cd354ab82f3edee17d5ffe38437b908f8aac4f416371.exe"1⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
cmsetac.dll
mstwain32.exe
ntdtcstp.dll
memory/1460-24-0x0000000003B20000-0x0000000003B2E000-memory.dmp
memory/1460-26-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-11-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-15-0x0000000003B20000-0x0000000003B2E000-memory.dmp
memory/1460-62-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-19-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-18-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-20-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-21-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-22-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-25-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-59-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-23-0x0000000000960000-0x0000000000968000-memory.dmp
memory/1460-3-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-29-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-32-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-35-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-38-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-41-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-44-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-47-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-50-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-53-0x0000000000400000-0x000000000044B000-memory.dmp
memory/1460-56-0x0000000000400000-0x000000000044B000-memory.dmp
memory/6100-0-0x0000000000438000-0x0000000000439000-memory.dmp
memory/6100-2-0x0000000000400000-0x000000000044B000-memory.dmp