Overview

overview

10

Static

static

3

f86bb9515f...8a.exe

windows7-x64

10

f86bb9515f...8a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f86bb9515fc4cc9de72e6c4f49ff1b8a

  • Size

    338KB

  • Sample

    231228-z1wcwafdfq

  • MD5

    f86bb9515fc4cc9de72e6c4f49ff1b8a

  • SHA1

    3b4c632f59d426f92f992d74401197808105be0e

  • SHA256

    a21979b47a2dc05af1585e8fb666b4a99fa806ae2cb52d89ff51c9dab4904a6c

  • SHA512

    9be55f2a89c57c3d7d949902ccf97268a1a6381f54d21b24a8c794d28946218e32ab0938961ffaef81e7b25b4e47c7e625f84b31565f420cee5c7052c43ec3f6

  • SSDEEP

    6144:23mw1VgIlsB9E4G6/SBCUuUnelyc+XTP9o9+e1V2esHp7kQe:wlsB9E4GCSBCUuUnelyc+Xy+3esHNq

Score
10/10
modiloaderevasionpersistencetrojan

Malware Config

Targets

    • Target

      f86bb9515fc4cc9de72e6c4f49ff1b8a

    • Size

      338KB

    • MD5

      f86bb9515fc4cc9de72e6c4f49ff1b8a

    • SHA1

      3b4c632f59d426f92f992d74401197808105be0e

    • SHA256

      a21979b47a2dc05af1585e8fb666b4a99fa806ae2cb52d89ff51c9dab4904a6c

    • SHA512

      9be55f2a89c57c3d7d949902ccf97268a1a6381f54d21b24a8c794d28946218e32ab0938961ffaef81e7b25b4e47c7e625f84b31565f420cee5c7052c43ec3f6

    • SSDEEP

      6144:23mw1VgIlsB9E4G6/SBCUuUnelyc+XTP9o9+e1V2esHp7kQe:wlsB9E4GCSBCUuUnelyc+Xy+3esHNq

    Score
    10/10
    modiloaderevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks