Overview

overview

10

Static

static

4f62bc0a78...e7.exe

windows7-x64

10

4f62bc0a78...e7.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4f62bc0a78728dc3d6d35cdf6771c1407185700f4235768ca32941d3ed4ed5e7

  • Size

    431KB

  • Sample

    221001-2qjbnsbhbq

  • MD5

    6d08c56a6603c26396f06a90c99c0c15

  • SHA1

    5145f99ac3eebecc6fd11e34b5965ed2e1ae930c

  • SHA256

    4f62bc0a78728dc3d6d35cdf6771c1407185700f4235768ca32941d3ed4ed5e7

  • SHA512

    187439ccd4217b01ff92c7ffb0b4bb8a8116ca9a33de55ad28b6cfae4be521f8ce434bf5f5f488f51d1bc32e6f6c198237e67765c1d85b4b77695bb25470c401

  • SSDEEP

    12288:ma/2anFpagJtRoqt2oFDGcHGjeskqkjQG:ma/tnGQt2oFDG95kL

Score
10/10
modiloadertrojan

Malware Config

Targets

    • Target

      4f62bc0a78728dc3d6d35cdf6771c1407185700f4235768ca32941d3ed4ed5e7

    • Size

      431KB

    • MD5

      6d08c56a6603c26396f06a90c99c0c15

    • SHA1

      5145f99ac3eebecc6fd11e34b5965ed2e1ae930c

    • SHA256

      4f62bc0a78728dc3d6d35cdf6771c1407185700f4235768ca32941d3ed4ed5e7

    • SHA512

      187439ccd4217b01ff92c7ffb0b4bb8a8116ca9a33de55ad28b6cfae4be521f8ce434bf5f5f488f51d1bc32e6f6c198237e67765c1d85b4b77695bb25470c401

    • SSDEEP

      12288:ma/2anFpagJtRoqt2oFDGcHGjeskqkjQG:ma/tnGQt2oFDG95kL

    Score
    10/10
    modiloadertrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks