Overview

overview

10

Static

static

10

befae85cc0...cs.exe

windows7-x64

10

befae85cc0...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    befae85cc0f064c1f2127cadc1cacf20_NeikiAnalytics

  • Size

    35KB

  • Sample

    240516-jhyghsah58

  • MD5

    befae85cc0f064c1f2127cadc1cacf20

  • SHA1

    0dba1d6eb976cc6669133cee81aed0bb0269b6e6

  • SHA256

    597abfd64e5cec3bf8650a632332bdd345027c4666f41a89290e62987d4df3b1

  • SHA512

    5ee93408592d0cf766b02e0ebbd95a19ec96f5a13ab6a496f4aa823edcbcf4a20b573458c0d3de1b9bbe5309b2ccae85ed4b16ef6ebe24aca3a7a8681796e927

  • SSDEEP

    768:Q8JqCbJQmkDx2Q8EyAC8DpqcjnxHJ+Vy3BYlZY:cC1kDpq+nH+g36Y

Score
10/10
modiloaderpersistencetrojan

Malware Config

Targets

    • Target

      befae85cc0f064c1f2127cadc1cacf20_NeikiAnalytics

    • Size

      35KB

    • MD5

      befae85cc0f064c1f2127cadc1cacf20

    • SHA1

      0dba1d6eb976cc6669133cee81aed0bb0269b6e6

    • SHA256

      597abfd64e5cec3bf8650a632332bdd345027c4666f41a89290e62987d4df3b1

    • SHA512

      5ee93408592d0cf766b02e0ebbd95a19ec96f5a13ab6a496f4aa823edcbcf4a20b573458c0d3de1b9bbe5309b2ccae85ed4b16ef6ebe24aca3a7a8681796e927

    • SSDEEP

      768:Q8JqCbJQmkDx2Q8EyAC8DpqcjnxHJ+Vy3BYlZY:cC1kDpq+nH+g36Y

    Score
    10/10
    modiloaderpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Modifies Installed Components in the registry

      persistence

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks