Overview

overview

10

Static

static

8bacd661f6...f4.exe

windows7-x64

10

8bacd661f6...f4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8bacd661f6d8f9d38b65f79b94ce9702b762f0936211516a3944b1f62b46a8f4

  • Size

    1.5MB

  • Sample

    221201-hzdyrsab2s

  • MD5

    9352efed8e3e40f5f569b60cbc3d5fae

  • SHA1

    f13a98ffcd41d92b63d7f2ee3d4f9cad57bbd08b

  • SHA256

    8bacd661f6d8f9d38b65f79b94ce9702b762f0936211516a3944b1f62b46a8f4

  • SHA512

    9a468ae4ede841036089a9c124e3d9bf14e21b3a2d5422ab10e433d3588144fe06f7214557a90fa260b00511bac201d7a9211715cee19ad7c5ef33b84ed987dd

  • SSDEEP

    24576:XNUzXKZdvPTOOrMQ0425/JgpHYiI9D0+22WPdhC+X2d3LByko:X/HTOOrMTp/JgpNI9iPdhgEko

Score
10/10
modiloaderevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      8bacd661f6d8f9d38b65f79b94ce9702b762f0936211516a3944b1f62b46a8f4

    • Size

      1.5MB

    • MD5

      9352efed8e3e40f5f569b60cbc3d5fae

    • SHA1

      f13a98ffcd41d92b63d7f2ee3d4f9cad57bbd08b

    • SHA256

      8bacd661f6d8f9d38b65f79b94ce9702b762f0936211516a3944b1f62b46a8f4

    • SHA512

      9a468ae4ede841036089a9c124e3d9bf14e21b3a2d5422ab10e433d3588144fe06f7214557a90fa260b00511bac201d7a9211715cee19ad7c5ef33b84ed987dd

    • SSDEEP

      24576:XNUzXKZdvPTOOrMQ0425/JgpHYiI9D0+22WPdhC+X2d3LByko:X/HTOOrMTp/JgpNI9iPdhgEko

    Score
    10/10
    modiloaderevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

2
T1004

Registry Run Keys / Startup Folder

3
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Modify Registry

8
T1112

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks