Overview

overview

10

Static

static

7

7e5ed0f125...67.exe

windows7-x64

10

7e5ed0f125...67.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7e5ed0f125ebcfccc4c256c1b753e367

  • Size

    999KB

  • Sample

    240129-agwrvsdge9

  • MD5

    7e5ed0f125ebcfccc4c256c1b753e367

  • SHA1

    c4ab02cfae62e0ab4932233f7397f41057bf362c

  • SHA256

    ea6b7a5a586cff0836c14018509e93ddcf75b524694c2a6bda166efd1d86f9c9

  • SHA512

    d2f2a31df5a11a6c52038d06dfbd2b57656e8fe51cd505bbf8abc204b6f733a4e085ff1267b5e7a48e46b73c4f03e712fbb603dea54a3fd6532988164d11ca82

  • SSDEEP

    24576:ThAyNr5Xk6cJvH3scLUwo6ZEjmW0cfU43dzux:WyNr+6cdpo1mwc43Bu

Score
10/10
modiloaderevasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      7e5ed0f125ebcfccc4c256c1b753e367

    • Size

      999KB

    • MD5

      7e5ed0f125ebcfccc4c256c1b753e367

    • SHA1

      c4ab02cfae62e0ab4932233f7397f41057bf362c

    • SHA256

      ea6b7a5a586cff0836c14018509e93ddcf75b524694c2a6bda166efd1d86f9c9

    • SHA512

      d2f2a31df5a11a6c52038d06dfbd2b57656e8fe51cd505bbf8abc204b6f733a4e085ff1267b5e7a48e46b73c4f03e712fbb603dea54a3fd6532988164d11ca82

    • SSDEEP

      24576:ThAyNr5Xk6cJvH3scLUwo6ZEjmW0cfU43dzux:WyNr+6cdpo1mwc43Bu

    Score
    10/10
    modiloaderevasionpersistencethemidatrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Deletes itself

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks