Overview

overview

10

Static

static

6b4f9cb6b2...84.exe

windows7-x64

10

6b4f9cb6b2...84.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6b4f9cb6b26d5feffa071f11d8f49a590c6f8656f896f22b6a28e87ad33ec484

  • Size

    921KB

  • Sample

    221003-yssrcaded2

  • MD5

    69a7a0dfb88149f2af59c37580049400

  • SHA1

    6024ec70d707a983764125e030334d36905669a4

  • SHA256

    6b4f9cb6b26d5feffa071f11d8f49a590c6f8656f896f22b6a28e87ad33ec484

  • SHA512

    9a6868a679664f52ffb350471ca7469473b624fba4e871980d64a8778f3ceb09e3858b7781ce3923ec1c3d36bd672856d06424b64e81a9334debad6979407421

  • SSDEEP

    24576:jlEAoyInhYf9x6NpphiNCG6KBTlBhcsn8ucsWBWQtf:BrtInhYf9x6NppYwG6KBRBXncsWBdf

Score
10/10
modiloaderevasionpersistencetrojan

Malware Config

Targets

    • Target

      6b4f9cb6b26d5feffa071f11d8f49a590c6f8656f896f22b6a28e87ad33ec484

    • Size

      921KB

    • MD5

      69a7a0dfb88149f2af59c37580049400

    • SHA1

      6024ec70d707a983764125e030334d36905669a4

    • SHA256

      6b4f9cb6b26d5feffa071f11d8f49a590c6f8656f896f22b6a28e87ad33ec484

    • SHA512

      9a6868a679664f52ffb350471ca7469473b624fba4e871980d64a8778f3ceb09e3858b7781ce3923ec1c3d36bd672856d06424b64e81a9334debad6979407421

    • SSDEEP

      24576:jlEAoyInhYf9x6NpphiNCG6KBTlBhcsn8ucsWBWQtf:BrtInhYf9x6NppYwG6KBRBXncsWBdf

    Score
    10/10
    modiloaderevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies firewall policy service

      evasion

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

3
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Modify Registry

8
T1112

Bypass User Account Control

1
T1088

Disabling Security Tools

3
T1089

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks