Overview

overview

10

Static

static

1

feb4160c04...a6.exe

windows7-x64

10

feb4160c04...a6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6

  • Size

    76KB

  • Sample

    221128-btgzxahh21

  • MD5

    224eafc304152362f7da0a216c4d4afa

  • SHA1

    363a0434337e70d7a65d9f6f244c37c192f1381e

  • SHA256

    feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6

  • SHA512

    32da63ae2492a2b1cd7e92525e36175bf46f80f33108dc551b6a59a38e57ba3c29a7c9adfbdee03625e591781293bdb16db548413c917a74e4b0d9fa0a1b3bea

  • SSDEEP

    1536:NQ1uILGBZbj4GUUQT0DrXJ6xOWtGcjt7+7Jriua/wd/x4Hyfh:NQoOG/Xth9DrXJmOWtGcjtS7Juurd/+w

Score
10/10
modiloaderpersistencetrojanupx

Malware Config

Targets

    • Target

      feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6

    • Size

      76KB

    • MD5

      224eafc304152362f7da0a216c4d4afa

    • SHA1

      363a0434337e70d7a65d9f6f244c37c192f1381e

    • SHA256

      feb4160c04797471ba1ee5673f181e719706f5950eecbb119de20575dc9612a6

    • SHA512

      32da63ae2492a2b1cd7e92525e36175bf46f80f33108dc551b6a59a38e57ba3c29a7c9adfbdee03625e591781293bdb16db548413c917a74e4b0d9fa0a1b3bea

    • SSDEEP

      1536:NQ1uILGBZbj4GUUQT0DrXJ6xOWtGcjt7+7Jriua/wd/x4Hyfh:NQoOG/Xth9DrXJmOWtGcjtS7Juurd/+w

    Score
    10/10
    modiloaderpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks