Overview

overview

10

Static

static

3

payload.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    payload.exe

  • Size

    1.2MB

  • Sample

    240606-smd34sfg4y

  • MD5

    4d817a69110373bdddd38cc48e0dea99

  • SHA1

    1d6b94e10e0e505385cb4c11eb35b9cb125e733b

  • SHA256

    9c2258154d012c1b3672fa4a393277f19bed2a6e953991a1100691ee4860c2e8

  • SHA512

    05562e254dea7d350a0fabdca31257f7145f00524a79bd88173825f7cc8ecedb618e3f5c66294e07461dafa48c29b6f9c3a879ad186a1dd251c10e524f09cb56

  • SSDEEP

    24576:QpFb3Jd89aZ6djkQgnFvyDKJmw3LoP/aYniKTi6iBRcqVXLv6h:Qp/mCFqWJmML/Z76h

Score
10/10
modiloaderexecutionpersistencetrojan

Malware Config

Targets

    • Target

      payload.exe

    • Size

      1.2MB

    • MD5

      4d817a69110373bdddd38cc48e0dea99

    • SHA1

      1d6b94e10e0e505385cb4c11eb35b9cb125e733b

    • SHA256

      9c2258154d012c1b3672fa4a393277f19bed2a6e953991a1100691ee4860c2e8

    • SHA512

      05562e254dea7d350a0fabdca31257f7145f00524a79bd88173825f7cc8ecedb618e3f5c66294e07461dafa48c29b6f9c3a879ad186a1dd251c10e524f09cb56

    • SSDEEP

      24576:QpFb3Jd89aZ6djkQgnFvyDKJmw3LoP/aYniKTi6iBRcqVXLv6h:Qp/mCFqWJmML/Z76h

    Score
    10/10
    modiloaderexecutionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks