Overview

overview

10

Static

static

8

1738efb839...ca.exe

windows7-x64

10

1738efb839...ca.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1738efb8390fed1fcb7981733bfb2cbeb897a5b95ba84eb221d128a343b97eca

  • Size

    1.3MB

  • Sample

    221123-21mrvaed2w

  • MD5

    523ed7cc3003948ce9a3578c02d5f1c2

  • SHA1

    2b1676c60b35b13d25b1918c07de4506aeadf21a

  • SHA256

    1738efb8390fed1fcb7981733bfb2cbeb897a5b95ba84eb221d128a343b97eca

  • SHA512

    ffe61322fc0816d3ec5eb191f28846dc01dfd0a08db0da05d553cfc7aff6b3af340fc95ebfd5aeb54969398f3bce865edfb862afd7897e1f8a9193aa1823aa4b

  • SSDEEP

    24576:YswJcyKXJxYu3C02nB3Tj9FyTQGxoDi9j19/SkgEdIz5rYBH:YswJcy9r02nBWTQO11lSkg6QrU

Score
10/10
modiloaderaspackv2evasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      1738efb8390fed1fcb7981733bfb2cbeb897a5b95ba84eb221d128a343b97eca

    • Size

      1.3MB

    • MD5

      523ed7cc3003948ce9a3578c02d5f1c2

    • SHA1

      2b1676c60b35b13d25b1918c07de4506aeadf21a

    • SHA256

      1738efb8390fed1fcb7981733bfb2cbeb897a5b95ba84eb221d128a343b97eca

    • SHA512

      ffe61322fc0816d3ec5eb191f28846dc01dfd0a08db0da05d553cfc7aff6b3af340fc95ebfd5aeb54969398f3bce865edfb862afd7897e1f8a9193aa1823aa4b

    • SSDEEP

      24576:YswJcyKXJxYu3C02nB3Tj9FyTQGxoDi9j19/SkgEdIz5rYBH:YswJcy9r02nBWTQO11lSkg6QrU

    Score
    10/10
    modiloaderaspackv2evasionpersistencethemidatrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Deletes itself

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

3
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks