modiloader | 0f92eae790fce354b6f7f4ddc2dd948110bd9d7f75bf137797ed1d7057ca8653 | Triage

Submit
Reports

Overview

overview

Static

static

7

0f92eae790...53.exe

windows7-x64

0f92eae790...53.exe

windows10-2004-x64

7

Sharing

General

Target

0f92eae790fce354b6f7f4ddc2dd948110bd9d7f75bf137797ed1d7057ca8653
Size

767KB
Sample

221021-gelmfaebbm
MD5

127dae08f6eb3ed6ad048658d2bf0b83
SHA1

1f2136a8f880225f5dbab0a947846e69eac19dfd
SHA256

0f92eae790fce354b6f7f4ddc2dd948110bd9d7f75bf137797ed1d7057ca8653
SHA512

7dd7cd4670b2c18de2c254b1b05ee952623f2a14063e8a46ac8cafc92d5f9522d97882181f2665032aa18539090f24cf9a86acac46a4ae1e168aec91fe1dd7f8
SSDEEP

12288:QaANTNd2QMMmhtpQVnlrKzFPJYJ0Ze3MNxlpCtdRHY1dlLKhAFOijNbsPtwown7T:iNT72QMMErKFoPuoeO2RHaTKKOaNbeab

Score

10^/10

modiloader evasion persistence themida trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

0f92eae790fce354b6f7f4ddc2dd948110bd9d7f75bf137797ed1d7057ca8653.exe

Resource

win7-20220901-en

modiloader evasion persistence themida trojan

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

0f92eae790fce354b6f7f4ddc2dd948110bd9d7f75bf137797ed1d7057ca8653.exe

Resource

win10v2004-20220901-en

evasion themida

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Targets

- Target
  
  0f92eae790fce354b6f7f4ddc2dd948110bd9d7f75bf137797ed1d7057ca8653
- Size
  
  767KB
- MD5
  
  127dae08f6eb3ed6ad048658d2bf0b83
- SHA1
  
  1f2136a8f880225f5dbab0a947846e69eac19dfd
- SHA256
  
  0f92eae790fce354b6f7f4ddc2dd948110bd9d7f75bf137797ed1d7057ca8653
- SHA512
  
  7dd7cd4670b2c18de2c254b1b05ee952623f2a14063e8a46ac8cafc92d5f9522d97882181f2665032aa18539090f24cf9a86acac46a4ae1e168aec91fe1dd7f8
- SSDEEP
  
  12288:QaANTNd2QMMmhtpQVnlrKzFPJYJ0Ze3MNxlpCtdRHY1dlLKhAFOijNbsPtwown7T:iNT72QMMErKFoPuoeO2RHaTKKOaNbeab
Score

10^/10

modiloader evasion persistence themida trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- UAC bypass
  evasion trojan
- ModiLoader Second Stage
- Executes dropped EXE
- Deletes itself
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderevasionpersistencethemidatrojan

behavioral2

© 2018-2025

Terms | Privacy