Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 04:44
Behavioral task
behavioral1
Sample
jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe
- Size 45KB
- Sample260925-fdcgpsys7m
- SHA256 b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97
- MD5 900fbf48cd4e8af880a309bb545cc711
- SHA1 b7cd925fa2e448e9e34fd8859fe2ee0f3d3c14e5
- SHA512 dc8fdbedf1af6d7414e6c04d63b8dd630285cbf4d1c8cb3c8ccd044270778e42ddad970d10a10435ff7c0dbda175700db4068a3514824aa3e5cdb2705a4ea573
- SSDEEP 768:VL11dGgc0kJTyoqYQdSbtXsnpq5OpBlqKbNlEfVb78muXb9QuV:vmyyGoqYQdSbtIcOpBlqulokVX6uV
- TLSH T177238D8BA6C7D871C5145AFD0C10C27A963F3970392969BBBAE80EDECDBE152381C157
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/files/0x001300000001b1c0-0.dat modiloader_stage2 - Executes dropped EXE 1 IoCs
pid Process 2004 tcpip.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\tcpip.exe jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe File created C:\Windows\SysWOW64\llldbww.bat jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe File created C:\Windows\SysWOW64\msiupdata.dll tcpip.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 932 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tcpip.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 2004 tcpip.exe 2004 tcpip.exe 2004 tcpip.exe 2004 tcpip.exe 2004 tcpip.exe 2004 tcpip.exe 2004 tcpip.exe 2004 tcpip.exe 2004 tcpip.exe 2004 tcpip.exe 2004 tcpip.exe 2004 tcpip.exe 2004 tcpip.exe 2004 tcpip.exe 2004 tcpip.exe 2004 tcpip.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 2004 tcpip.exe 2004 tcpip.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe Token: SeDebugPrivilege 2004 tcpip.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4248 wrote to memory of 932 4248 jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\llldbww.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:932
-
-
C:\Windows\SysWOW64\tcpip.exeC:\Windows\SysWOW64\tcpip.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2004
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\llldbww.bat
- Size 282B
- SHA256 42c2290d96eb957fcfc5e43483227c510127ca003035843cf1afa851fcebd9b9
- MD5 151dc12a0041899f09e08ad7a0b7b40b
- SHA1 c3fcc532454799df221d89ab4bd556deafbb8cfc
- SHA512 52d9ae0c36ea379f49db4a4a57b8a5631c979dfb0e5b20af631cf80df02e6fe0f1cbc80d8ae65b363a10b404829da1c10015a3f423455ac2fe4914b64efe82a6
- TLSH T115D02BE16B02F16D888C444B0E70CFCD80B48D7817C82B074A16C1DDD193028F2DDA8C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\tcpip.exe
- Size 45KB
- SHA256 b90d74e869b629a4622861e0544e021e1641facb7795a9a2819519145170ca97
- MD5 900fbf48cd4e8af880a309bb545cc711
- SHA1 b7cd925fa2e448e9e34fd8859fe2ee0f3d3c14e5
- SHA512 dc8fdbedf1af6d7414e6c04d63b8dd630285cbf4d1c8cb3c8ccd044270778e42ddad970d10a10435ff7c0dbda175700db4068a3514824aa3e5cdb2705a4ea573
- SSDEEP 768:VL11dGgc0kJTyoqYQdSbtXsnpq5OpBlqKbNlEfVb78muXb9QuV:vmyyGoqYQdSbtIcOpBlqulokVX6uV
- TLSH T177238D8BA6C7D871C5145AFD0C10C27A963F3970392969BBBAE80EDECDBE152381C157
- MD5 SHA1 SHA512 SSDEEP TLSH