Analysis
- max time kernel
148s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 10:55
Behavioral task
behavioral1
Sample
jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
General
- Target jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
- Size 297KB
- Sample261014-m1eznstvbx
- SHA256 b997bb443ea002434983ee039b548dcb2976003295fdebc2a7c9881fec927147
- MD5 033ace27448cf3f01ae661dba55cd22a
- SHA1 e87ce0a0d370ac095b7b86d80b048f447e3774cb
- SHA512 65466c473c3d2e1972ee4e36736c4cf3ce44cb7cf376d38344788734005d8f3d884809d28e09e266ff2e031414e992e3fe1684164104adf3fb1a33020234e526
- SSDEEP 6144:Xh8P7F+Z5fDPHBPmmBousE3k1KzYlJAWn8MB1NVjkPAM5VZEY26rPNF6Kk2+u:2SfTHBPFoCXzYlJVn71NVjUACiY7rP/M
- TLSH T1CE542379BB4FE412CCE547F1DB1AC6ED2A66AE1704590A4743E0254F2DB116CF40BA3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 16 IoCs
resource yara_rule behavioral2/memory/4052-2-0x0000000000400000-0x00000000004DC000-memory.dmp modiloader_stage2 behavioral2/memory/4052-3-0x0000000000400000-0x00000000004DC000-memory.dmp modiloader_stage2 behavioral2/memory/4052-4-0x0000000000400000-0x00000000004DC000-memory.dmp modiloader_stage2 behavioral2/memory/4052-5-0x0000000000400000-0x00000000004DC000-memory.dmp modiloader_stage2 behavioral2/memory/4052-6-0x0000000000400000-0x00000000004DC000-memory.dmp modiloader_stage2 behavioral2/memory/4052-7-0x0000000000400000-0x00000000004DC000-memory.dmp modiloader_stage2 behavioral2/memory/4052-8-0x0000000000400000-0x00000000004DC000-memory.dmp modiloader_stage2 behavioral2/memory/4052-9-0x0000000000400000-0x00000000004DC000-memory.dmp modiloader_stage2 behavioral2/memory/4052-10-0x0000000000400000-0x00000000004DC000-memory.dmp modiloader_stage2 behavioral2/memory/4052-11-0x0000000000400000-0x00000000004DC000-memory.dmp modiloader_stage2 behavioral2/memory/4052-12-0x0000000000400000-0x00000000004DC000-memory.dmp modiloader_stage2 behavioral2/memory/4052-13-0x0000000000400000-0x00000000004DC000-memory.dmp modiloader_stage2 behavioral2/memory/4052-14-0x0000000000400000-0x00000000004DC000-memory.dmp modiloader_stage2 behavioral2/memory/4052-15-0x0000000000400000-0x00000000004DC000-memory.dmp modiloader_stage2 behavioral2/memory/4052-16-0x0000000000400000-0x00000000004DC000-memory.dmp modiloader_stage2 behavioral2/memory/4052-17-0x0000000000400000-0x00000000004DC000-memory.dmp modiloader_stage2 -
resource yara_rule behavioral2/memory/4052-0-0x0000000000400000-0x00000000004DC000-memory.dmp upx behavioral2/memory/4052-2-0x0000000000400000-0x00000000004DC000-memory.dmp upx behavioral2/memory/4052-3-0x0000000000400000-0x00000000004DC000-memory.dmp upx behavioral2/memory/4052-4-0x0000000000400000-0x00000000004DC000-memory.dmp upx behavioral2/memory/4052-5-0x0000000000400000-0x00000000004DC000-memory.dmp upx behavioral2/memory/4052-6-0x0000000000400000-0x00000000004DC000-memory.dmp upx behavioral2/memory/4052-7-0x0000000000400000-0x00000000004DC000-memory.dmp upx behavioral2/memory/4052-8-0x0000000000400000-0x00000000004DC000-memory.dmp upx behavioral2/memory/4052-9-0x0000000000400000-0x00000000004DC000-memory.dmp upx behavioral2/memory/4052-10-0x0000000000400000-0x00000000004DC000-memory.dmp upx behavioral2/memory/4052-11-0x0000000000400000-0x00000000004DC000-memory.dmp upx behavioral2/memory/4052-12-0x0000000000400000-0x00000000004DC000-memory.dmp upx behavioral2/memory/4052-13-0x0000000000400000-0x00000000004DC000-memory.dmp upx behavioral2/memory/4052-14-0x0000000000400000-0x00000000004DC000-memory.dmp upx behavioral2/memory/4052-15-0x0000000000400000-0x00000000004DC000-memory.dmp upx behavioral2/memory/4052-16-0x0000000000400000-0x00000000004DC000-memory.dmp upx behavioral2/memory/4052-17-0x0000000000400000-0x00000000004DC000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_UDS.DangerousObject.Multi.Generic.exe