Overview

overview

10

Static

static

3403f595a3...83.exe

windows7-x64

10

3403f595a3...83.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3403f595a3a1adeade31927c13425fd7e40bc3d7b8f7c64ac57089158733ad83

  • Size

    328KB

  • Sample

    221127-kmxapadb57

  • MD5

    3ae10c0e373a4c876bcd949944f6a896

  • SHA1

    53245cb22dc7ec8022c9d9121bb7b1a8c58a8e20

  • SHA256

    3403f595a3a1adeade31927c13425fd7e40bc3d7b8f7c64ac57089158733ad83

  • SHA512

    cc7054630e7bb509d0f189a081f3e4411eb866f2ecc0def29c34a120e9f88cbd61b79f679077d7344bf70f807370455eeb17965d576d9ea8c7c88b5a642f9b18

  • SSDEEP

    6144:jWplkmphlfqqxmMlVP+Can3/0Go8TRBHJWo7UMoe0:SplkMtk2VPUn8yHV7UMoe

Score
10/10
modiloaderevasionpersistencetrojan

Malware Config

Targets

    • Target

      3403f595a3a1adeade31927c13425fd7e40bc3d7b8f7c64ac57089158733ad83

    • Size

      328KB

    • MD5

      3ae10c0e373a4c876bcd949944f6a896

    • SHA1

      53245cb22dc7ec8022c9d9121bb7b1a8c58a8e20

    • SHA256

      3403f595a3a1adeade31927c13425fd7e40bc3d7b8f7c64ac57089158733ad83

    • SHA512

      cc7054630e7bb509d0f189a081f3e4411eb866f2ecc0def29c34a120e9f88cbd61b79f679077d7344bf70f807370455eeb17965d576d9ea8c7c88b5a642f9b18

    • SSDEEP

      6144:jWplkmphlfqqxmMlVP+Can3/0Go8TRBHJWo7UMoe0:SplkMtk2VPUn8yHV7UMoe

    Score
    10/10
    modiloaderevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Adds policy Run key to start application

      persistence

    • Disables use of System Restore points

      evasion

    • Deletes itself

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

1
T1490

Tasks