modiloader | e477a8097003204eb7f070ee081fdf996ad7239e4468b4a6bfc13abd36a4cd80 | Triage

Submit
Reports

Overview

overview

Static

static

e477a80970...80.exe

windows7-x64

e477a80970...80.exe

windows10-2004-x64

Sharing

General

Target

e477a8097003204eb7f070ee081fdf996ad7239e4468b4a6bfc13abd36a4cd80
Size

1.8MB
Sample

221127-m6pfasfg31
MD5

2ede29b32d18267e6a736be17d4f4664
SHA1

43673541f114e5071145932886e69266f0f3f166
SHA256

e477a8097003204eb7f070ee081fdf996ad7239e4468b4a6bfc13abd36a4cd80
SHA512

6af657c000f19f0ab3b47fcffe2e1e80cb5bf55cb5096a2ad467e4a2eb2f6ac5398b9b57747e098d1331d46bcc6282786cc3804976bce0838ae837ec0fbed63d
SSDEEP

49152:AoQU9Z5Y4+YSembcj3jjTcDuNML851cM9whEWby9o1Kx0J7w:AoQU9Z64+YFmb03jju0ML8ncMmGWbyqY

Score

10^/10

modiloader persistence trojan upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

e477a8097003204eb7f070ee081fdf996ad7239e4468b4a6bfc13abd36a4cd80.exe

Resource

win7-20221111-en

modiloader persistence trojan upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

e477a8097003204eb7f070ee081fdf996ad7239e4468b4a6bfc13abd36a4cd80.exe

Resource

win10v2004-20221111-en

modiloader persistence trojan upx

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  e477a8097003204eb7f070ee081fdf996ad7239e4468b4a6bfc13abd36a4cd80
- Size
  
  1.8MB
- MD5
  
  2ede29b32d18267e6a736be17d4f4664
- SHA1
  
  43673541f114e5071145932886e69266f0f3f166
- SHA256
  
  e477a8097003204eb7f070ee081fdf996ad7239e4468b4a6bfc13abd36a4cd80
- SHA512
  
  6af657c000f19f0ab3b47fcffe2e1e80cb5bf55cb5096a2ad467e4a2eb2f6ac5398b9b57747e098d1331d46bcc6282786cc3804976bce0838ae837ec0fbed63d
- SSDEEP
  
  49152:AoQU9Z5Y4+YSembcj3jjTcDuNML851cM9whEWby9o1Kx0J7w:AoQU9Z64+YFmb03jju0ML8ncMmGWbyqY
Score

10^/10

modiloader persistence trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderpersistencetrojanupx

behavioral2

modiloaderpersistencetrojanupx

© 2018-2024

Terms | Privacy