Overview

overview

10

Static

static

3

Price-list...54.exe

windows7-x64

10

Price-list...54.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    58f6534ece6b72af1d5f1139602a0e81_JaffaCakes118

  • Size

    784KB

  • Sample

    240519-g26acseb7x

  • MD5

    58f6534ece6b72af1d5f1139602a0e81

  • SHA1

    d8ad50ce09f83f4c48958dadfa60681585158d3d

  • SHA256

    890bbe475734f839aa2bf1cf29259b1d51734edfda448ecaafb33b14f4f3846b

  • SHA512

    c318afb06b02feb50b673b2e425a1d80a2997f87f3fc3b38aa0696c4cc369422faa024710f2bc4cab56b4131f14cace2e415cbf446e7411ab07030898ff2a528

  • SSDEEP

    12288:FZMbXTIqS/SNjY8Vaw3ccagWju/6UOnpFF06ZIOXa7/JYzKto9AYy4hFVLr9iO0:sbXcq9jY8IHfgWjBp06ZpMJYqoC49it

Score
10/10
modiloaderbootkitpersistencetrojanupx

Malware Config

Targets

    • Target

      Price-list-Yuan 2016.6.8_545_54.exe

    • Size

      912KB

    • MD5

      0564ba769d20df8f127c1f491e6a5540

    • SHA1

      f4c47f8fd8a402bdd5c05aff882b1dace1633186

    • SHA256

      153df0b62b32abea05a68d9f9bdb1d0ceadd5fe04dd1334b7d6053afb67309fe

    • SHA512

      e6b3a837db38293ed6a4cca20af53a2cb0387af61945e9fdcf78da3ba2a8ffa47172ddff1fcf262d23812dc72205bd32156c46215d46a88525986f1afa317fee

    • SSDEEP

      24576:ETzSqlFYcq/ZgmvTZ06L5+JYmm2gackH:ELTCvvt0g4JYNazH

    Score
    10/10
    modiloaderbootkitpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Adds policy Run key to start application

      persistence

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

3
T1547.001

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

3
T1547.001

Defense Evasion

Modify Registry

4
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks