Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 17:42
Behavioral task
behavioral1
Sample
16e885a93bb3f19bc9e75377f1cb605e_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
16e885a93bb3f19bc9e75377f1cb605e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
16e885a93bb3f19bc9e75377f1cb605e_JaffaCakes118.exe
-
Size
91KB
-
MD5
16e885a93bb3f19bc9e75377f1cb605e
-
SHA1
aae388065985f5be63bab7bd4486cae2145fdf3e
-
SHA256
41699ad99079830c50a938e33ec49c76645477efa2d993c13a7ec01bd48e65f0
-
SHA512
640c9bbe8c46571ec5aef0c3dc35ecbba85a097eea8f669dca38a216a52f17ce07fc98b09c77624dac94f09a81e9cd8d64167059e4a07ccf4473e17a1975b96f
-
SSDEEP
1536:irq5KUQeq5LYoNZLpY8CmJRz6bQsKnTSWPCrOWrZ4grGJ9y7K:rKUnoLPNZy+/nt0O7gyW7K
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3932-0-0x0000000000400000-0x000000000041C000-memory.dmp modiloader_stage2 behavioral2/memory/3932-4-0x0000000000400000-0x000000000041C000-memory.dmp modiloader_stage2 -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
16e885a93bb3f19bc9e75377f1cb605e_JaffaCakes118.exedescription pid process target process PID 3932 wrote to memory of 3584 3932 16e885a93bb3f19bc9e75377f1cb605e_JaffaCakes118.exe ping.exe PID 3932 wrote to memory of 3584 3932 16e885a93bb3f19bc9e75377f1cb605e_JaffaCakes118.exe ping.exe PID 3932 wrote to memory of 3584 3932 16e885a93bb3f19bc9e75377f1cb605e_JaffaCakes118.exe ping.exe