Overview

overview

10

Static

static

97128f122e...cd.exe

windows7-x64

10

97128f122e...cd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    97128f122e12bcc73541a633ff0e192b1b34c8b90504be5e2e60e705659375cd

  • Size

    449KB

  • Sample

    221128-gml8yaaf77

  • MD5

    3d20d40a5579b44a270b257953fa0a94

  • SHA1

    89afe0eba146ccedaa396f4ce8cb6b4860c9b480

  • SHA256

    97128f122e12bcc73541a633ff0e192b1b34c8b90504be5e2e60e705659375cd

  • SHA512

    310e544bd4cbb3bb8cd8e024479a4153e713b3ec02b97680aee200708af5996028697d5bb32ac121b6a2bf22961acb02ef54abbb3f5f2498c1417b76b5de5a94

  • SSDEEP

    12288:YTrn0U7AqPMtRZWb6ehVqRHusbLAl/tcW9viiVVg:er0U7DPCRGhVoH9bLAEMvFVC

Score
10/10
modiloaderevasionpersistencetrojan

Malware Config

Targets

    • Target

      97128f122e12bcc73541a633ff0e192b1b34c8b90504be5e2e60e705659375cd

    • Size

      449KB

    • MD5

      3d20d40a5579b44a270b257953fa0a94

    • SHA1

      89afe0eba146ccedaa396f4ce8cb6b4860c9b480

    • SHA256

      97128f122e12bcc73541a633ff0e192b1b34c8b90504be5e2e60e705659375cd

    • SHA512

      310e544bd4cbb3bb8cd8e024479a4153e713b3ec02b97680aee200708af5996028697d5bb32ac121b6a2bf22961acb02ef54abbb3f5f2498c1417b76b5de5a94

    • SSDEEP

      12288:YTrn0U7AqPMtRZWb6ehVqRHusbLAl/tcW9viiVVg:er0U7DPCRGhVoH9bLAEMvFVC

    Score
    10/10
    modiloaderevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Checks for common network interception software

      Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

      evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • ModiLoader Second Stage

    • Adds policy Run key to start application

      persistence

    • Disables use of System Restore points

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks