modiloader | 704402fbf64510e2bb2196be7885fe6610d8dc5ccb44fe3b3d70709505a9a12c | Triage

Submit
Reports

Overview

overview

Static

static

8

704402fbf6...2c.exe

windows7-x64

704402fbf6...2c.exe

windows10-2004-x64

Sharing

General

Target

704402fbf64510e2bb2196be7885fe6610d8dc5ccb44fe3b3d70709505a9a12c
Size

132KB
Sample

221125-phr8dsga77
MD5

64d4ca887876be25e89bad93d654e239
SHA1

4dd0e735a37d20870b5543b03bd6ae82b532cdaf
SHA256

704402fbf64510e2bb2196be7885fe6610d8dc5ccb44fe3b3d70709505a9a12c
SHA512

6c062d89c322506aaaa343c78d0e2614fa892edeab901f5e0c24e16a46d862355efb224a7020f741c33fc90b0ed042a36b822c4f7b82e6e60bfd5efb64ca7234
SSDEEP

3072:a1+MJKrUnFYY5z1i0Nmbi5fJBNr/i5jS7outxXPg:aIrPj0NmWtNr/i5WoSxXP

Score

10^/10

modiloader evasion persistence trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

704402fbf64510e2bb2196be7885fe6610d8dc5ccb44fe3b3d70709505a9a12c.exe

Resource

win7-20220812-en

modiloader evasion persistence trojan upx

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

704402fbf64510e2bb2196be7885fe6610d8dc5ccb44fe3b3d70709505a9a12c.exe

Resource

win10v2004-20220901-en

modiloader evasion persistence trojan upx

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  704402fbf64510e2bb2196be7885fe6610d8dc5ccb44fe3b3d70709505a9a12c
- Size
  
  132KB
- MD5
  
  64d4ca887876be25e89bad93d654e239
- SHA1
  
  4dd0e735a37d20870b5543b03bd6ae82b532cdaf
- SHA256
  
  704402fbf64510e2bb2196be7885fe6610d8dc5ccb44fe3b3d70709505a9a12c
- SHA512
  
  6c062d89c322506aaaa343c78d0e2614fa892edeab901f5e0c24e16a46d862355efb224a7020f741c33fc90b0ed042a36b822c4f7b82e6e60bfd5efb64ca7234
- SSDEEP
  
  3072:a1+MJKrUnFYY5z1i0Nmbi5fJBNr/i5jS7outxXPg:aIrPj0NmWtNr/i5WoSxXP
Score

10^/10

modiloader evasion persistence trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- UAC bypass
  evasion trojan
- ModiLoader Second Stage
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderevasionpersistencetrojanupx

behavioral2

modiloaderevasionpersistencetrojanupx

© 2018-2024

Terms | Privacy