Overview

overview

10

Static

static

3

7d3199b23e...cs.exe

windows7-x64

7

7d3199b23e...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7d3199b23ebb5029a9675808a010f320_NeikiAnalytics

  • Size

    112KB

  • Sample

    240510-f3949sgg89

  • MD5

    7d3199b23ebb5029a9675808a010f320

  • SHA1

    30b17629b85004775b78ab155d3702b707d0b975

  • SHA256

    7b1ae61d17143dda8ef6a02327bf056623663571915e81f5f8702964c0e7981a

  • SHA512

    1ae270e1d104161fb90dbed33920218741922bc7033509f0dc7e87083fb8365bd06961890ca3b7741abe5e7aba1fa017ef95c792bf78ce1a9eb9c72dee7c462c

  • SSDEEP

    1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5

Score
10/10
modiloaderpersistencetrojanupx

Malware Config

Targets

    • Target

      7d3199b23ebb5029a9675808a010f320_NeikiAnalytics

    • Size

      112KB

    • MD5

      7d3199b23ebb5029a9675808a010f320

    • SHA1

      30b17629b85004775b78ab155d3702b707d0b975

    • SHA256

      7b1ae61d17143dda8ef6a02327bf056623663571915e81f5f8702964c0e7981a

    • SHA512

      1ae270e1d104161fb90dbed33920218741922bc7033509f0dc7e87083fb8365bd06961890ca3b7741abe5e7aba1fa017ef95c792bf78ce1a9eb9c72dee7c462c

    • SSDEEP

      1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5

    Score
    10/10
    upxmodiloaderpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks