Overview

overview

10

Static

static

4a394d708c...f1.exe

windows7-x64

10

4a394d708c...f1.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4a394d708ca551bad4384929cc5bb8f08244dabf68670d6b8a91db94e3e3adf1

  • Size

    338KB

  • Sample

    221019-ra3p9sbcej

  • MD5

    a250a7cff5ba00718bbeeb74ba2475a1

  • SHA1

    22eecb5066dfb496a3defadb80aa7496a57bced4

  • SHA256

    4a394d708ca551bad4384929cc5bb8f08244dabf68670d6b8a91db94e3e3adf1

  • SHA512

    7d5a642bc7481d66fc3432432e1e9ab3d6cea2bb470aa393ac84115c627bb4329b79daf65ea5eedc288e6fd75657117b29b047568336ddc771d5470486940a15

  • SSDEEP

    6144:S6/HuVY4R1fUWrY4DvbyofsvolDesaUi27dkk/W+gfz:S6/OVfj8WrY4DzyusCeZBedkk/W+g7

Score
10/10
modiloadertrojan

Malware Config

Targets

    • Target

      4a394d708ca551bad4384929cc5bb8f08244dabf68670d6b8a91db94e3e3adf1

    • Size

      338KB

    • MD5

      a250a7cff5ba00718bbeeb74ba2475a1

    • SHA1

      22eecb5066dfb496a3defadb80aa7496a57bced4

    • SHA256

      4a394d708ca551bad4384929cc5bb8f08244dabf68670d6b8a91db94e3e3adf1

    • SHA512

      7d5a642bc7481d66fc3432432e1e9ab3d6cea2bb470aa393ac84115c627bb4329b79daf65ea5eedc288e6fd75657117b29b047568336ddc771d5470486940a15

    • SSDEEP

      6144:S6/HuVY4R1fUWrY4DvbyofsvolDesaUi27dkk/W+gfz:S6/OVfj8WrY4DzyusCeZBedkk/W+g7

    Score
    10/10
    modiloadertrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks