Overview

overview

10

Static

static

1

e3d4a7502d...05.exe

windows7-x64

10

e3d4a7502d...05.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e3d4a7502d49c4438694ff302ddaf71f249adfdb178476f3209f045bdfb66105

  • Size

    67KB

  • Sample

    221126-erphrabb47

  • MD5

    3d4410617f4a0de0df91d6f5e3fc65f1

  • SHA1

    e69e54fbf9112af28aa3917a034719a37e3865db

  • SHA256

    e3d4a7502d49c4438694ff302ddaf71f249adfdb178476f3209f045bdfb66105

  • SHA512

    969dd3ea2158c8deb4cd1ce1cbff23a09e349d8b0bce1bf4ddd97491566879d623b6eb1d60116ab5fb42d2e33fa658ef77f1010c4ae1145df6ba578efc2cd6cd

  • SSDEEP

    1536:R4UHxpN/MUXsLTvCj0DBXJaOUtfaWePmFU6oQREj+VIbCw:R4URpNUUX6z/DBXJfmfaWIyPREj5r

Score
10/10
modiloaderpersistencetrojanupx

Malware Config

Targets

    • Target

      e3d4a7502d49c4438694ff302ddaf71f249adfdb178476f3209f045bdfb66105

    • Size

      67KB

    • MD5

      3d4410617f4a0de0df91d6f5e3fc65f1

    • SHA1

      e69e54fbf9112af28aa3917a034719a37e3865db

    • SHA256

      e3d4a7502d49c4438694ff302ddaf71f249adfdb178476f3209f045bdfb66105

    • SHA512

      969dd3ea2158c8deb4cd1ce1cbff23a09e349d8b0bce1bf4ddd97491566879d623b6eb1d60116ab5fb42d2e33fa658ef77f1010c4ae1145df6ba578efc2cd6cd

    • SSDEEP

      1536:R4UHxpN/MUXsLTvCj0DBXJaOUtfaWePmFU6oQREj+VIbCw:R4URpNUUX6z/DBXJfmfaWIyPREj5r

    Score
    10/10
    modiloaderpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks