Overview

overview

10

Static

static

10

58e0721a64...cf.exe

windows7-x64

10

58e0721a64...cf.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    58e0721a64d92c01f9154b801b9c1e5aef6397c03f736ec42e8298b4b732d2cf

  • Size

    270KB

  • Sample

    240810-1rsq3azdmm

  • MD5

    9b740136d5717eaa08ea479cfe07b51f

  • SHA1

    ceee82b2e6491c9a2de4ccf9063c679a76084ef5

  • SHA256

    58e0721a64d92c01f9154b801b9c1e5aef6397c03f736ec42e8298b4b732d2cf

  • SHA512

    8517bfbb464879d26efdc3342b8d8a5868239928646fe370816a0662f44e054e1bada062b9160a2e46c6b856e6c11bbfc19146194fa925617891f0c31ee4d8de

  • SSDEEP

    6144:xG377xS2Vp2CeiorXdwTBgWx4v53rWpcCJJvHq:kr7xS2Vp6RwTyC7bJJvHq

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      58e0721a64d92c01f9154b801b9c1e5aef6397c03f736ec42e8298b4b732d2cf

    • Size

      270KB

    • MD5

      9b740136d5717eaa08ea479cfe07b51f

    • SHA1

      ceee82b2e6491c9a2de4ccf9063c679a76084ef5

    • SHA256

      58e0721a64d92c01f9154b801b9c1e5aef6397c03f736ec42e8298b4b732d2cf

    • SHA512

      8517bfbb464879d26efdc3342b8d8a5868239928646fe370816a0662f44e054e1bada062b9160a2e46c6b856e6c11bbfc19146194fa925617891f0c31ee4d8de

    • SSDEEP

      6144:xG377xS2Vp2CeiorXdwTBgWx4v53rWpcCJJvHq:kr7xS2Vp6RwTyC7bJJvHq

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks