modiloader | 4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479 | Triage

Sharing

General

Target

4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479
Size

994KB
Sample

221126-z4t9zsee57
MD5

e8d1ba2baf31e50c594b39f6e8259827
SHA1

c5a82f2170089b6e73f8d23946e037c9ab27901e
SHA256

4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479
SHA512

c0f8861e95ad8e7d247368cd9efa9812c7765bae9533589e43d22c7810cf3ead0a18002450deaeedaeec3b1f426c95ec9784bedec49b44c95d8345dc15cc0709
SSDEEP

24576:bJ1G2X131Rc5sUQxButHmYj8lJTeasASBlEev:v1FWsXx4tGcKTed/l1

Score

10^/10

modiloader evasion persistence

Malware Config

Targets

- Target
  
  4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479
- Size
  
  994KB
- MD5
  
  e8d1ba2baf31e50c594b39f6e8259827
- SHA1
  
  c5a82f2170089b6e73f8d23946e037c9ab27901e
- SHA256
  
  4cf6ac1b2dcf9f45ae7bc774814558eb90f7c4a9b520cf237d9f4aa2cacbb479
- SHA512
  
  c0f8861e95ad8e7d247368cd9efa9812c7765bae9533589e43d22c7810cf3ead0a18002450deaeedaeec3b1f426c95ec9784bedec49b44c95d8345dc15cc0709
- SSDEEP
  
  24576:bJ1G2X131Rc5sUQxButHmYj8lJTeasASBlEev:v1FWsXx4tGcKTed/l1
Score

8^/10

evasion persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence