Overview

overview

10

Static

static

3

b9f3f20c8d...30.exe

windows7-x64

10

b9f3f20c8d...30.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b9f3f20c8de3b6702aa0c756ea2eb8fa2acb839343a724896e83acb959773f30.exe

  • Size

    1.5MB

  • Sample

    230803-wtgpcsfc94

  • MD5

    6fa19067c2ced397f594d9f60442533c

  • SHA1

    e4710fa3aed0d22967181e4de053d2cab30d9af4

  • SHA256

    b9f3f20c8de3b6702aa0c756ea2eb8fa2acb839343a724896e83acb959773f30

  • SHA512

    560ef1f53f136e8b6e0cb323ecb2f193e61fc85545674a0837f0386ea8219eead14d7112710027230985b084ff8d4737638549d4fc8cfeb6828d517ef8371b67

  • SSDEEP

    24576:a30AU6QvVe3VQihYCjEHKPj13Dhazz9b9ZTZKjsWwySYO/I2jfW7xfSb8OUsfx:aE6bhfj4GBT2z95ZWnwyZO/I2jfW7BPG

Score
10/10
modiloaderpersistencetrojan

Malware Config

Targets

    • Target

      b9f3f20c8de3b6702aa0c756ea2eb8fa2acb839343a724896e83acb959773f30.exe

    • Size

      1.5MB

    • MD5

      6fa19067c2ced397f594d9f60442533c

    • SHA1

      e4710fa3aed0d22967181e4de053d2cab30d9af4

    • SHA256

      b9f3f20c8de3b6702aa0c756ea2eb8fa2acb839343a724896e83acb959773f30

    • SHA512

      560ef1f53f136e8b6e0cb323ecb2f193e61fc85545674a0837f0386ea8219eead14d7112710027230985b084ff8d4737638549d4fc8cfeb6828d517ef8371b67

    • SSDEEP

      24576:a30AU6QvVe3VQihYCjEHKPj13Dhazz9b9ZTZKjsWwySYO/I2jfW7xfSb8OUsfx:aE6bhfj4GBT2z95ZWnwyZO/I2jfW7BPG

    Score
    10/10
    modiloadertrojanpersistence

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks