Overview

overview

10

Static

static

3

payload.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    payload.exe

  • Size

    1.2MB

  • Sample

    240606-smd34sfg4y

  • MD5

    4d817a69110373bdddd38cc48e0dea99

  • SHA1

    1d6b94e10e0e505385cb4c11eb35b9cb125e733b

  • SHA256

    9c2258154d012c1b3672fa4a393277f19bed2a6e953991a1100691ee4860c2e8

  • SHA512

    05562e254dea7d350a0fabdca31257f7145f00524a79bd88173825f7cc8ecedb618e3f5c66294e07461dafa48c29b6f9c3a879ad186a1dd251c10e524f09cb56

  • SSDEEP

    24576:QpFb3Jd89aZ6djkQgnFvyDKJmw3LoP/aYniKTi6iBRcqVXLv6h:Qp/mCFqWJmML/Z76h

Score
10/10
modiloaderexecutionpersistencetrojan

Malware Config

Targets

    • Target

      payload.exe

    • Size

      1.2MB

    • MD5

      4d817a69110373bdddd38cc48e0dea99

    • SHA1

      1d6b94e10e0e505385cb4c11eb35b9cb125e733b

    • SHA256

      9c2258154d012c1b3672fa4a393277f19bed2a6e953991a1100691ee4860c2e8

    • SHA512

      05562e254dea7d350a0fabdca31257f7145f00524a79bd88173825f7cc8ecedb618e3f5c66294e07461dafa48c29b6f9c3a879ad186a1dd251c10e524f09cb56

    • SSDEEP

      24576:QpFb3Jd89aZ6djkQgnFvyDKJmw3LoP/aYniKTi6iBRcqVXLv6h:Qp/mCFqWJmML/Z76h

    Score
    10/10
    modiloaderexecutionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks