Overview

overview

10

Static

static

3

f64504e860...e2.exe

windows7-x64

10

f64504e860...e2.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f64504e860faff868e8674a67881cee2

  • Size

    1.3MB

  • Sample

    231228-zcme3abgdj

  • MD5

    f64504e860faff868e8674a67881cee2

  • SHA1

    4743613cb5572e4d9f7c796f974fe2e8f7772abe

  • SHA256

    3265fe0d40f5fc8fd2c92c8794108a9375fda9f2cfafdac99c6994daff45befa

  • SHA512

    c3bc98e2d373c640a3c09db62fce75edc988612aee7f6472d239fbe6606de9d87e010adff19aadf7cfc512742fcc7791bc73e8a15b4d816405501f007ae90b99

  • SSDEEP

    24576:2cGl5ZvtGOQxMPoVgXco9/MTV5NpkE2RfdZJhMFXB53tXM:yrtGOyMPoVgMgUZ5bkZR1ZTMd3RM

Score
10/10
modiloaderevasionpersistencetrojan

Malware Config

Targets

    • Target

      f64504e860faff868e8674a67881cee2

    • Size

      1.3MB

    • MD5

      f64504e860faff868e8674a67881cee2

    • SHA1

      4743613cb5572e4d9f7c796f974fe2e8f7772abe

    • SHA256

      3265fe0d40f5fc8fd2c92c8794108a9375fda9f2cfafdac99c6994daff45befa

    • SHA512

      c3bc98e2d373c640a3c09db62fce75edc988612aee7f6472d239fbe6606de9d87e010adff19aadf7cfc512742fcc7791bc73e8a15b4d816405501f007ae90b99

    • SSDEEP

      24576:2cGl5ZvtGOQxMPoVgXco9/MTV5NpkE2RfdZJhMFXB53tXM:yrtGOyMPoVgMgUZ5bkZR1ZTMd3RM

    Score
    10/10
    modiloaderevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks