Overview

overview

10

Static

static

38bd4c2d12...2b.exe

windows7_x64

8

38bd4c2d12...2b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    38bd4c2d12d2223f6eb3039808ae53490dfb07aef2826e535ae3f38617afd02b

  • Size

    1.8MB

  • Sample

    220714-n51bvagaen

  • MD5

    9e2d1b4046564b749f7f2fd6d0fdd495

  • SHA1

    62ba2d1184d701f04bc34c5de5064e422a9f17ef

  • SHA256

    38bd4c2d12d2223f6eb3039808ae53490dfb07aef2826e535ae3f38617afd02b

  • SHA512

    e209d3a6db83f766b240da2a91b8faf6d19023918b45b98ad87226522ecb6441bce6d3ed78dba7d214e061fe6ed49ce28524a7a1acc262f378fc253a9e9aece9

Score
10/10
modiloaderevasionsuricatathemidatrojan

Malware Config

Targets

    • Target

      38bd4c2d12d2223f6eb3039808ae53490dfb07aef2826e535ae3f38617afd02b

    • Size

      1.8MB

    • MD5

      9e2d1b4046564b749f7f2fd6d0fdd495

    • SHA1

      62ba2d1184d701f04bc34c5de5064e422a9f17ef

    • SHA256

      38bd4c2d12d2223f6eb3039808ae53490dfb07aef2826e535ae3f38617afd02b

    • SHA512

      e209d3a6db83f766b240da2a91b8faf6d19023918b45b98ad87226522ecb6441bce6d3ed78dba7d214e061fe6ed49ce28524a7a1acc262f378fc253a9e9aece9

    Score
    10/10
    modiloaderevasionsuricatathemidatrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent

      suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent

      suricata

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • ModiLoader Second Stage

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks