Overview

overview

10

Static

static

10

10b798dec8...44.exe

windows7-x64

1

10b798dec8...44.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    10b798dec86c9741d311c88dad14e344

  • Size

    186KB

  • Sample

    231225-jxh1dagbfr

  • MD5

    10b798dec86c9741d311c88dad14e344

  • SHA1

    b6994e3db4d17a5c1dc87fef89009924d5abc552

  • SHA256

    f8d71f555d508646d1bd67fe8d6af42f2d049e5be16f2324666504c539a36de9

  • SHA512

    d7b09c323e9369a454a24fd8975362a9ca770d73a95f6cd21931a8529fb3b86e4d5cef3844e828f75d7f6c6a7debb7c26d31910b6abea7017fda2b99d4c334ac

  • SSDEEP

    3072:rDIpv6Kx9o1hgW5/slL3DKEIF2F5LwCU+Yqp7jIpgY3ro2+TTvB3ZQeCB9T:rDIpNx21hgaU8MLbDpq73r4vBiT7T

Score
10/10
modiloaderpersistencetrojan

Malware Config

Targets

    • Target

      10b798dec86c9741d311c88dad14e344

    • Size

      186KB

    • MD5

      10b798dec86c9741d311c88dad14e344

    • SHA1

      b6994e3db4d17a5c1dc87fef89009924d5abc552

    • SHA256

      f8d71f555d508646d1bd67fe8d6af42f2d049e5be16f2324666504c539a36de9

    • SHA512

      d7b09c323e9369a454a24fd8975362a9ca770d73a95f6cd21931a8529fb3b86e4d5cef3844e828f75d7f6c6a7debb7c26d31910b6abea7017fda2b99d4c334ac

    • SSDEEP

      3072:rDIpv6Kx9o1hgW5/slL3DKEIF2F5LwCU+Yqp7jIpgY3ro2+TTvB3ZQeCB9T:rDIpNx21hgaU8MLbDpq73r4vBiT7T

    Score
    10/10
    modiloaderpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks