modiloader | b7791d1985f604a1e430db1a314d8e668a116368fbdbd1c0eec7c819f794572e | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

b7791d1985...2e.exe

windows7-x64

b7791d1985...2e.exe

windows10-2004-x64

Sharing

General

Target

b7791d1985f604a1e430db1a314d8e668a116368fbdbd1c0eec7c819f794572e
Size

369KB
Sample

221201-xlxlaaad84
MD5

a9f53f717119d87ef37cd69455bdf7c8
SHA1

558d1d89590e28d305ad31c3dde0e3b1dd4a9d92
SHA256

b7791d1985f604a1e430db1a314d8e668a116368fbdbd1c0eec7c819f794572e
SHA512

3168b45551e29474a0c5d267de367c5d343336aa8372e77974f73840fd4f5289a2140134710f7e723cd38033e79016f5a34109269874f6169a6479892882a6d0
SSDEEP

6144:0YKgiBqURlqw4FVSa1IOi8ms255DlQMX8Pn6YWiRI716L17Ab:49BqW49jKO8pKMXcnl9RI71u1Ub

Score

10^/10

modiloader persistence trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

b7791d1985f604a1e430db1a314d8e668a116368fbdbd1c0eec7c819f794572e.exe

Resource

win7-20220901-en

modiloader persistence trojan upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

b7791d1985f604a1e430db1a314d8e668a116368fbdbd1c0eec7c819f794572e.exe

Resource

win10v2004-20221111-en

modiloader persistence trojan upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  b7791d1985f604a1e430db1a314d8e668a116368fbdbd1c0eec7c819f794572e
- Size
  
  369KB
- MD5
  
  a9f53f717119d87ef37cd69455bdf7c8
- SHA1
  
  558d1d89590e28d305ad31c3dde0e3b1dd4a9d92
- SHA256
  
  b7791d1985f604a1e430db1a314d8e668a116368fbdbd1c0eec7c819f794572e
- SHA512
  
  3168b45551e29474a0c5d267de367c5d343336aa8372e77974f73840fd4f5289a2140134710f7e723cd38033e79016f5a34109269874f6169a6479892882a6d0
- SSDEEP
  
  6144:0YKgiBqURlqw4FVSa1IOi8ms255DlQMX8Pn6YWiRI716L17Ab:49BqW49jKO8pKMXcnl9RI71u1Ub
Score

10^/10

modiloader persistence trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderpersistencetrojanupx

behavioral2

modiloaderpersistencetrojanupx

© 2018-2025

Terms | Privacy