Overview

overview

10

Static

static

73c7eb2e42...08.exe

windows7-x64

10

73c7eb2e42...08.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    73c7eb2e42263217d441a25d7228a3aaa6842e0be78a81823bbc823005a87f08

  • Size

    416KB

  • Sample

    221019-2g543sbdfl

  • MD5

    920e3bb05f3a373e2386af3c5ecc8fe0

  • SHA1

    faaf2e372e8e781eaefffa1155ab39f84ae9ee26

  • SHA256

    73c7eb2e42263217d441a25d7228a3aaa6842e0be78a81823bbc823005a87f08

  • SHA512

    6ddec975f2137551a41a7f9bc6783f3f161c5e11328c861e476915daf38d5d9be2a4b710c8487b1e7faad4812210780891fe41e8f3486877b37e49c26dfa24cf

  • SSDEEP

    12288:tQKUBB1lYrQ7e60UmaLO9Si0gV4L4F5vhOMUkLPTs:FUBB1vi60eL0SjgVes5vd4

Score
10/10
modiloaderevasionpersistencetrojan

Malware Config

Targets

    • Target

      73c7eb2e42263217d441a25d7228a3aaa6842e0be78a81823bbc823005a87f08

    • Size

      416KB

    • MD5

      920e3bb05f3a373e2386af3c5ecc8fe0

    • SHA1

      faaf2e372e8e781eaefffa1155ab39f84ae9ee26

    • SHA256

      73c7eb2e42263217d441a25d7228a3aaa6842e0be78a81823bbc823005a87f08

    • SHA512

      6ddec975f2137551a41a7f9bc6783f3f161c5e11328c861e476915daf38d5d9be2a4b710c8487b1e7faad4812210780891fe41e8f3486877b37e49c26dfa24cf

    • SSDEEP

      12288:tQKUBB1lYrQ7e60UmaLO9Si0gV4L4F5vhOMUkLPTs:FUBB1vi60eL0SjgVes5vd4

    Score
    10/10
    modiloaderevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

      evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • ModiLoader Second Stage

    • Adds policy Run key to start application

      persistence

    • Disables use of System Restore points

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks