Overview

overview

10

Static

static

9

e2ec00adb3...b5.exe

windows7_x64

10

e2ec00adb3...b5.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    145s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 18:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e2ec00adb32aea4d650f12ebb07e5c30ea4db55e5a8ef4e84f1b5d166f3c70b5.exe

  • Size

    509KB

  • MD5

    d2205fb386a508899ba9e1a6d4654ed2

  • SHA1

    d3937f1d1900f7cac13b328c051b3bcaf577226a

  • SHA256

    e2ec00adb32aea4d650f12ebb07e5c30ea4db55e5a8ef4e84f1b5d166f3c70b5

  • SHA512

    31c584c7e04ea73df541a33a8cfbfe3424646d52c7734b5ff694047234d644a5de6882c916c37a8b72f32c496ff47b699f17e664cb65046f129b44ac2de4d3e9

Score
10/10
modiloaderpersistencetrojan

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • ModiLoader First Stage 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2ec00adb32aea4d650f12ebb07e5c30ea4db55e5a8ef4e84f1b5d166f3c70b5.exe
    "C:\Users\Admin\AppData\Local\Temp\e2ec00adb32aea4d650f12ebb07e5c30ea4db55e5a8ef4e84f1b5d166f3c70b5.exe"
    1⤵
    • Adds Run key to start application
    PID:1944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1944-130-0x0000000002200000-0x0000000002256000-memory.dmp
    Filesize

    344KB

    Download
  • memory/1944-131-0x0000000000400000-0x0000000000481000-memory.dmp
    Filesize

    516KB

    Download