modiloader | 4f8418dc705be19e5d031bf388a698633541b5697f18c935013b011010f840ef | Triage

Submit
Reports

Overview

overview

Static

static

4f8418dc70...ef.exe

windows7-x64

8

4f8418dc70...ef.exe

windows10-2004-x64

8

Sharing

General

Target

4f8418dc705be19e5d031bf388a698633541b5697f18c935013b011010f840ef
Size

703KB
Sample

221126-r6bawsbf28
MD5

9936a450d518824463e30cf007020244
SHA1

14a72c0f04982dcda07a45ade15cf27d1b482ffe
SHA256

4f8418dc705be19e5d031bf388a698633541b5697f18c935013b011010f840ef
SHA512

16d0105bcd008000442ab6b61065e56e6c57e3aafde6231baa712c44510083f467ca07c52deca03c4aa42fa71301f955086bda442ae9fd272fcaa4869d7ec7fc
SSDEEP

12288:IwEjZRYiaqpvzSnGIJWDW4+FCOFehumXluwvRZX7jFjVHkoLic:UZeOvzS3JWDW4YC6ZmX3Z3VVV

Score

10^/10

modiloader aspackv2 evasion persistence

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

4f8418dc705be19e5d031bf388a698633541b5697f18c935013b011010f840ef.exe

Resource

win7-20221111-en

aspackv2 evasion persistence

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

4f8418dc705be19e5d031bf388a698633541b5697f18c935013b011010f840ef.exe

Resource

win10v2004-20220901-en

aspackv2 evasion persistence

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  4f8418dc705be19e5d031bf388a698633541b5697f18c935013b011010f840ef
- Size
  
  703KB
- MD5
  
  9936a450d518824463e30cf007020244
- SHA1
  
  14a72c0f04982dcda07a45ade15cf27d1b482ffe
- SHA256
  
  4f8418dc705be19e5d031bf388a698633541b5697f18c935013b011010f840ef
- SHA512
  
  16d0105bcd008000442ab6b61065e56e6c57e3aafde6231baa712c44510083f467ca07c52deca03c4aa42fa71301f955086bda442ae9fd272fcaa4869d7ec7fc
- SSDEEP
  
  12288:IwEjZRYiaqpvzSnGIJWDW4+FCOFehumXluwvRZX7jFjVHkoLic:UZeOvzS3JWDW4YC6ZmX3Z3VVV
Score

8^/10

aspackv2 evasion persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

aspackv2evasionpersistence

behavioral2

aspackv2evasionpersistence

© 2018-2024

Terms | Privacy