Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 08:37
Behavioral task
behavioral1
Sample
197aa9f5114ee5f3140cde6f57562b2b_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
197aa9f5114ee5f3140cde6f57562b2b_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
197aa9f5114ee5f3140cde6f57562b2b_JaffaCakes118.dll
-
Size
475KB
-
MD5
197aa9f5114ee5f3140cde6f57562b2b
-
SHA1
ce54f1bd971c0b38b2731bdb52599fc4b8508640
-
SHA256
a7455d58c3dd0a03e7ea75c18051881773fb48db0710add6555df5815415633b
-
SHA512
38a27869ec86298e533284496608052e7ae63edb6cdb7906005bddc3342195efb2bb1bbede1530f9571b1f9cfc49cfffca398dcf647c013e0983fc0ca79c134d
-
SSDEEP
12288:/6A+y1vbS+Vnjz936iOnQMkcB8mbpB+YBur:yA11vbS+VjZd2QMklypB+YQr
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2092-0-0x0000000000960000-0x00000000009DC000-memory.dmp modiloader_stage2 behavioral1/memory/2092-1-0x0000000000960000-0x00000000009DC000-memory.dmp modiloader_stage2 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2012 wrote to memory of 2092 2012 rundll32.exe rundll32.exe PID 2012 wrote to memory of 2092 2012 rundll32.exe rundll32.exe PID 2012 wrote to memory of 2092 2012 rundll32.exe rundll32.exe PID 2012 wrote to memory of 2092 2012 rundll32.exe rundll32.exe PID 2012 wrote to memory of 2092 2012 rundll32.exe rundll32.exe PID 2012 wrote to memory of 2092 2012 rundll32.exe rundll32.exe PID 2012 wrote to memory of 2092 2012 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\197aa9f5114ee5f3140cde6f57562b2b_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\197aa9f5114ee5f3140cde6f57562b2b_JaffaCakes118.dll,#12⤵