modiloader | 8da2d6db255bb6e6202c5ea9dc4571fbfb1c296babe19e6d449a6284f09bd811 | Triage

Submit
Reports

Overview

overview

Static

static

7

23fb51ef1c...18.exe

windows7-x64

23fb51ef1c...18.exe

windows10-2004-x64

7

Sharing

General

Target

23fb51ef1ca6dcc5c90dc41ddca78996_JaffaCakes118
Size

602KB
Sample

240704-alwbwsvhqe
MD5

23fb51ef1ca6dcc5c90dc41ddca78996
SHA1

416d4f3f036914e151d4e3489537354342b9f095
SHA256

8da2d6db255bb6e6202c5ea9dc4571fbfb1c296babe19e6d449a6284f09bd811
SHA512

b1a6b58d39211bddb2dee6466fa0b96fde5dc942316e4de8f89812af71f740184c5e010dd84bd6843828e70feb349b86b8195a7e41d9cda353909db744d8329a
SSDEEP

12288:1Yiod3zovTWjzDFBIlkTe6hnyvLYjWtSxosCsk4YIYPoL75VbLwqdCp:1Yio9zZPIlktyTWWWtkgYadVfwqdA

Score

10^/10

modiloader evasion themida trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

23fb51ef1ca6dcc5c90dc41ddca78996_JaffaCakes118.exe

Resource

win7-20240221-en

modiloader evasion themida trojan

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

23fb51ef1ca6dcc5c90dc41ddca78996_JaffaCakes118.exe

Resource

win10v2004-20240611-en

evasion themida

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Targets

- Target
  
  23fb51ef1ca6dcc5c90dc41ddca78996_JaffaCakes118
- Size
  
  602KB
- MD5
  
  23fb51ef1ca6dcc5c90dc41ddca78996
- SHA1
  
  416d4f3f036914e151d4e3489537354342b9f095
- SHA256
  
  8da2d6db255bb6e6202c5ea9dc4571fbfb1c296babe19e6d449a6284f09bd811
- SHA512
  
  b1a6b58d39211bddb2dee6466fa0b96fde5dc942316e4de8f89812af71f740184c5e010dd84bd6843828e70feb349b86b8195a7e41d9cda353909db744d8329a
- SSDEEP
  
  12288:1Yiod3zovTWjzDFBIlkTe6hnyvLYjWtSxosCsk4YIYPoL75VbLwqdCp:1Yio9zZPIlktyTWWWtkgYadVfwqdA
Score

10^/10

modiloader evasion themida trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderevasionthemidatrojan

behavioral2

© 2018-2024

Terms | Privacy