modiloader | 0b584fcc0cc05972800509c4e2ac0968512b4cd70106f4aa77fb0ac221a3a2d8 | Triage

Sharing

General

Target

0b584fcc0cc05972800509c4e2ac0968512b4cd70106f4aa77fb0ac221a3a2d8
Size

387KB
Sample

221126-cdme5add73
MD5

f18a5f7d163bf492b1c07a5eacea6753
SHA1

4a0fdabb151b8093a9f7a3ff8191961db0685031
SHA256

0b584fcc0cc05972800509c4e2ac0968512b4cd70106f4aa77fb0ac221a3a2d8
SHA512

bbb31e42a918ffa376c3c046ee7e857d89f524d7545f10ce9e8e46f0fdf973f0f0df26093ce6e7464a7699922f569578d935bc438e3dbe1aa75c6d2494f51d7a
SSDEEP

6144:y3MDzqEt6GSQOy4hzEqE8imE1oOOXv0uYm2nrjw:y30q2S4mcz1xO9Ymejw

Score

10^/10

modiloader evasion persistence

Malware Config

Targets

- Target
  
  0b584fcc0cc05972800509c4e2ac0968512b4cd70106f4aa77fb0ac221a3a2d8
- Size
  
  387KB
- MD5
  
  f18a5f7d163bf492b1c07a5eacea6753
- SHA1
  
  4a0fdabb151b8093a9f7a3ff8191961db0685031
- SHA256
  
  0b584fcc0cc05972800509c4e2ac0968512b4cd70106f4aa77fb0ac221a3a2d8
- SHA512
  
  bbb31e42a918ffa376c3c046ee7e857d89f524d7545f10ce9e8e46f0fdf973f0f0df26093ce6e7464a7699922f569578d935bc438e3dbe1aa75c6d2494f51d7a
- SSDEEP
  
  6144:y3MDzqEt6GSQOy4hzEqE8imE1oOOXv0uYm2nrjw:y30q2S4mcz1xO9Ymejw
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence