modiloader | 8d68747e827d72917ff2eea0224667ea7bfa1b14d0f6b77002eeb82f52bf2baf | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

8d68747e82...af.exe

windows7-x64

8d68747e82...af.exe

windows10-2004-x64

Sharing

General

Target

8d68747e827d72917ff2eea0224667ea7bfa1b14d0f6b77002eeb82f52bf2baf
Size

456KB
Sample

221129-mb79xsaa46
MD5

3515ad76d8276b16c4e98ad7516f857f
SHA1

4e49b4cd132032023b3b9a03126a3667c2327002
SHA256

8d68747e827d72917ff2eea0224667ea7bfa1b14d0f6b77002eeb82f52bf2baf
SHA512

71c198536a009dd8d59973978e8a3cfff10963732aeaff8d3198b4228bb64bca9e4058e9c9ed438373ec4bb525d0e872c3e78dd85733575fbdddbf2bdeb0d3e8
SSDEEP

12288:vNF4I4tiifwdqLHCcBMuKlKB1WaKjjsAWfwb:vr4MLdqLH2XjaKHnWc

Score

10^/10

modiloader evasion persistence trojan

Static task

static1

Behavioral task

behavioral1

Sample

8d68747e827d72917ff2eea0224667ea7bfa1b14d0f6b77002eeb82f52bf2baf.exe

Resource

win7-20220812-en

modiloader evasion persistence trojan

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

8d68747e827d72917ff2eea0224667ea7bfa1b14d0f6b77002eeb82f52bf2baf.exe

Resource

win10v2004-20220812-en

modiloader evasion persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  8d68747e827d72917ff2eea0224667ea7bfa1b14d0f6b77002eeb82f52bf2baf
- Size
  
  456KB
- MD5
  
  3515ad76d8276b16c4e98ad7516f857f
- SHA1
  
  4e49b4cd132032023b3b9a03126a3667c2327002
- SHA256
  
  8d68747e827d72917ff2eea0224667ea7bfa1b14d0f6b77002eeb82f52bf2baf
- SHA512
  
  71c198536a009dd8d59973978e8a3cfff10963732aeaff8d3198b4228bb64bca9e4058e9c9ed438373ec4bb525d0e872c3e78dd85733575fbdddbf2bdeb0d3e8
- SSDEEP
  
  12288:vNF4I4tiifwdqLHCcBMuKlKB1WaKjjsAWfwb:vr4MLdqLH2XjaKHnWc
Score

10^/10

modiloader evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- UAC bypass
  evasion trojan
- ModiLoader Second Stage
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderevasionpersistencetrojan

behavioral2

modiloaderevasionpersistencetrojan

© 2018-2025

Terms | Privacy