Overview

overview

10

Static

static

8

b57aae31d6...83.exe

windows7-x64

10

b57aae31d6...83.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b57aae31d652603c8b4452227becf1edcdbc851d9f03ded8ac567a3a70060783

  • Size

    400KB

  • Sample

    221205-tq2h9aab51

  • MD5

    f574a0b3535a2e36cd5a49e5d5d4873a

  • SHA1

    94590c998a2d60bb8407c8fe1cea45aa8b88c31e

  • SHA256

    b57aae31d652603c8b4452227becf1edcdbc851d9f03ded8ac567a3a70060783

  • SHA512

    bc984eaa2ac6cb7b340a8e7a455989854914e74f942cb82445afb784a216756ad5b23bdaa03adf1c154d10b6ef23dacd87ff03a7fb79f3535fb4e1f68e9bb0df

  • SSDEEP

    12288:g1PO8MeQh81uhNmq+jhfgKBRKnb/ZPSUuXzE:gPO8MeQS143+jhfjonb/Z6jI

Score
10/10
modiloaderevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      b57aae31d652603c8b4452227becf1edcdbc851d9f03ded8ac567a3a70060783

    • Size

      400KB

    • MD5

      f574a0b3535a2e36cd5a49e5d5d4873a

    • SHA1

      94590c998a2d60bb8407c8fe1cea45aa8b88c31e

    • SHA256

      b57aae31d652603c8b4452227becf1edcdbc851d9f03ded8ac567a3a70060783

    • SHA512

      bc984eaa2ac6cb7b340a8e7a455989854914e74f942cb82445afb784a216756ad5b23bdaa03adf1c154d10b6ef23dacd87ff03a7fb79f3535fb4e1f68e9bb0df

    • SSDEEP

      12288:g1PO8MeQh81uhNmq+jhfgKBRKnb/ZPSUuXzE:gPO8MeQS143+jhfjonb/Z6jI

    Score
    10/10
    modiloaderevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks