Overview

overview

10

Static

static

7

NEAS.dc684...a0.exe

windows7-x64

10

NEAS.dc684...a0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.dc68403f79dcc10185e91b1bc9fe23a0.exe

  • Size

    90KB

  • Sample

    231202-ybwfxafd83

  • MD5

    dc68403f79dcc10185e91b1bc9fe23a0

  • SHA1

    f94e83596dc678b7f16a8c8f05d173493cafd502

  • SHA256

    1ab12c9f3022b8bfd675d526bfec3b2f4077316bb712027174ceb5ca22e7aece

  • SHA512

    a6e2bf1dff57c5105de9010d75da20b7a8a56c54b6260cdfa807767b786728367aa7eaaae4439ed7abeee2c2bbb558b2cfe693dead0b055ba12e817a22613778

  • SSDEEP

    1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y

Score
10/10
modiloaderpersistencetrojanupx

Malware Config

Targets

    • Target

      NEAS.dc68403f79dcc10185e91b1bc9fe23a0.exe

    • Size

      90KB

    • MD5

      dc68403f79dcc10185e91b1bc9fe23a0

    • SHA1

      f94e83596dc678b7f16a8c8f05d173493cafd502

    • SHA256

      1ab12c9f3022b8bfd675d526bfec3b2f4077316bb712027174ceb5ca22e7aece

    • SHA512

      a6e2bf1dff57c5105de9010d75da20b7a8a56c54b6260cdfa807767b786728367aa7eaaae4439ed7abeee2c2bbb558b2cfe693dead0b055ba12e817a22613778

    • SSDEEP

      1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y

    Score
    10/10
    modiloaderpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks