Overview

overview

10

Static

static

3

Order conf...ed.exe

windows7-x64

10

Order conf...ed.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Order confirmation is attached.exe

  • Size

    769KB

  • Sample

    230502-jkvteaca2w

  • MD5

    64ce92242a4b896e952c57d6e8144bd4

  • SHA1

    167cf3fe9a09072bc3abe8d0ff957217201cfc63

  • SHA256

    f94be5630497d64da51b0a362279b6a60133365e60e27bbbc90f7767faed4f28

  • SHA512

    94636fca9f8b94295b49b53d85aad3ddf8f1916ab7376e6a504a28a316ac4f4b8a6d5ebc1b8fdf0e12a432d55f44340907bdada29f8599e921026b5f201a33df

  • SSDEEP

    12288:Hu+e4v0ma0dwwcQNHRh+ZXiwBdbPmWNQhnBMQfhxN2rn4PhWu7:HuRQq0iwcmhEffeW+zhxN2rn4P

Score
10/10
modiloaderpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      Order confirmation is attached.exe

    • Size

      769KB

    • MD5

      64ce92242a4b896e952c57d6e8144bd4

    • SHA1

      167cf3fe9a09072bc3abe8d0ff957217201cfc63

    • SHA256

      f94be5630497d64da51b0a362279b6a60133365e60e27bbbc90f7767faed4f28

    • SHA512

      94636fca9f8b94295b49b53d85aad3ddf8f1916ab7376e6a504a28a316ac4f4b8a6d5ebc1b8fdf0e12a432d55f44340907bdada29f8599e921026b5f201a33df

    • SSDEEP

      12288:Hu+e4v0ma0dwwcQNHRh+ZXiwBdbPmWNQhnBMQfhxN2rn4PhWu7:HuRQq0iwcmhEffeW+zhxN2rn4P

    Score
    10/10
    modiloadertrojanpersistencespywarestealer

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Blocklisted process makes network request

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks