Overview

overview

10

Static

static

10

04214b7cb6...79.exe

windows7-x64

10

04214b7cb6...79.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04214b7cb6d6f1852d2b758e7dc41f79

  • Size

    22KB

  • Sample

    220809-z3dkvagdcp

  • MD5

    04214b7cb6d6f1852d2b758e7dc41f79

  • SHA1

    09caf41f3ed70db23b39351fdd1dc657bcdc42fd

  • SHA256

    9ad8f4fc26ee9bb73266916caed4bf50100f308cb3cad13b62b3a5fe5c93c749

  • SHA512

    42ee1b27ecb6511fa96d8450a5511b46f738e45efe40623b8be1c857d0f00a72b3e25c3054d0174b15bee624b123b860ae68890e7f0e12ea49916f11edf81362

Score
10/10
modiloaderpersistencetrojanupx

Malware Config

Targets

    • Target

      04214b7cb6d6f1852d2b758e7dc41f79

    • Size

      22KB

    • MD5

      04214b7cb6d6f1852d2b758e7dc41f79

    • SHA1

      09caf41f3ed70db23b39351fdd1dc657bcdc42fd

    • SHA256

      9ad8f4fc26ee9bb73266916caed4bf50100f308cb3cad13b62b3a5fe5c93c749

    • SHA512

      42ee1b27ecb6511fa96d8450a5511b46f738e45efe40623b8be1c857d0f00a72b3e25c3054d0174b15bee624b123b860ae68890e7f0e12ea49916f11edf81362

    Score
    10/10
    modiloaderpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks