Overview

overview

10

Static

static

10

a4251c8bb6...fe.exe

windows7-x64

10

a4251c8bb6...fe.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a4251c8bb6b6eb1ec67e7e61f3766ac70a48252e971f07fefd52437e0794b1fe

  • Size

    651KB

  • Sample

    221205-zatrcsge51

  • MD5

    32060dbd8ee1657e7718bbca5d149bee

  • SHA1

    3b7fb85b512f1dd9c96a5bca2a64b73548f41f45

  • SHA256

    a4251c8bb6b6eb1ec67e7e61f3766ac70a48252e971f07fefd52437e0794b1fe

  • SHA512

    17501d10a37d13dd67347b3f0b94e89d544388d854cb02d13836015f554e423b44fe7960b34caa577d25a20d2428008e4ce56a51096c4ed28db783a1f52a4baa

  • SSDEEP

    12288:kpyZT16rCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx16jOD3SxcDDcNDqWYurL0

Score
10/10
modiloaderevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      a4251c8bb6b6eb1ec67e7e61f3766ac70a48252e971f07fefd52437e0794b1fe

    • Size

      651KB

    • MD5

      32060dbd8ee1657e7718bbca5d149bee

    • SHA1

      3b7fb85b512f1dd9c96a5bca2a64b73548f41f45

    • SHA256

      a4251c8bb6b6eb1ec67e7e61f3766ac70a48252e971f07fefd52437e0794b1fe

    • SHA512

      17501d10a37d13dd67347b3f0b94e89d544388d854cb02d13836015f554e423b44fe7960b34caa577d25a20d2428008e4ce56a51096c4ed28db783a1f52a4baa

    • SSDEEP

      12288:kpyZT16rCxu/mDwLRI6BxcDqp9aqCcajVuD3Z7BPQGMWYur0s0D:kUx16jOD3SxcDDcNDqWYurL0

    Score
    10/10
    modiloaderevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • ModiLoader Second Stage

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks