Overview

overview

10

Static

static

3

2d6cc4f5bd...2f.exe

windows7-x64

10

2d6cc4f5bd...2f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2d6cc4f5bdec3d16a4087b82aa785d2f

  • Size

    206KB

  • Sample

    231231-jbnnqsafa3

  • MD5

    2d6cc4f5bdec3d16a4087b82aa785d2f

  • SHA1

    696bc0bde02d408c31bf3666ee18229b174c2e82

  • SHA256

    e7eba8eea4beed8c13930545bb7b053102912301a547b7958d7d8fd730e79181

  • SHA512

    175d66969277dc8a1abd3270820f0829430487586676eab0651df8823dcd11290d5440a4979df405923103842d0cae42da0567e50c5933f997792947cb9d9817

  • SSDEEP

    6144:GdHYqqDGVAWSJJRqI610mg+zouKKdKWEE++Fi6zKV7/7k:GzqSO9Jnh60mg+ZaWEE++F5GDI

Score
10/10
modiloaderpersistencetrojan

Malware Config

Targets

    • Target

      2d6cc4f5bdec3d16a4087b82aa785d2f

    • Size

      206KB

    • MD5

      2d6cc4f5bdec3d16a4087b82aa785d2f

    • SHA1

      696bc0bde02d408c31bf3666ee18229b174c2e82

    • SHA256

      e7eba8eea4beed8c13930545bb7b053102912301a547b7958d7d8fd730e79181

    • SHA512

      175d66969277dc8a1abd3270820f0829430487586676eab0651df8823dcd11290d5440a4979df405923103842d0cae42da0567e50c5933f997792947cb9d9817

    • SSDEEP

      6144:GdHYqqDGVAWSJJRqI610mg+zouKKdKWEE++Fi6zKV7/7k:GzqSO9Jnh60mg+ZaWEE++F5GDI

    Score
    10/10
    modiloaderpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Adds policy Run key to start application

      persistence

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks