Overview

overview

10

Static

static

c9bfacf4a3...be.exe

windows7-x64

10

c9bfacf4a3...be.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c9bfacf4a3cef8e1cc65b1b66d2b94fbf3a54cce4e3a65807df877a274ed75be

  • Size

    982KB

  • Sample

    230130-e38qrsaf8y

  • MD5

    8d4ca9867e0f2f59057a0a5ab23442de

  • SHA1

    74aaa823e441bcd0e1075652bce2c234f702f8cf

  • SHA256

    c9bfacf4a3cef8e1cc65b1b66d2b94fbf3a54cce4e3a65807df877a274ed75be

  • SHA512

    40c0650470360868cac3624cabbfa7ed7ccbb0954e5f80866825aa87d9a61aca5c6af0d8d2db8617fe1f2265938beb7b6dbf268774de95d5dd0544f484cfe5ba

  • SSDEEP

    24576:wvh/9klHiSFnRdP3QYSel9Z+m8a6rsYShuOAq:gh87j4ax6ghuw

Score
10/10
modiloaderevasionpersistencetrojan

Malware Config

Targets

    • Target

      c9bfacf4a3cef8e1cc65b1b66d2b94fbf3a54cce4e3a65807df877a274ed75be

    • Size

      982KB

    • MD5

      8d4ca9867e0f2f59057a0a5ab23442de

    • SHA1

      74aaa823e441bcd0e1075652bce2c234f702f8cf

    • SHA256

      c9bfacf4a3cef8e1cc65b1b66d2b94fbf3a54cce4e3a65807df877a274ed75be

    • SHA512

      40c0650470360868cac3624cabbfa7ed7ccbb0954e5f80866825aa87d9a61aca5c6af0d8d2db8617fe1f2265938beb7b6dbf268774de95d5dd0544f484cfe5ba

    • SSDEEP

      24576:wvh/9klHiSFnRdP3QYSel9Z+m8a6rsYShuOAq:gh87j4ax6ghuw

    Score
    10/10
    modiloaderevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks