Overview

overview

10

Static

static

3

9436f16cd7...18.exe

windows7-x64

10

9436f16cd7...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118

  • Size

    886KB

  • Sample

    240813-wyc7qstepq

  • MD5

    9436f16cd747610be4d4f0f1b8d6461c

  • SHA1

    d943722404f4616413d1bc7c7466e29c0670b78a

  • SHA256

    479c0addb9eac7d4f5db9df8932724c68b9edd07e3a62d3aac4692606d2266f7

  • SHA512

    9c1bdc6f1c9f6b2fd76655c344aa3f1720b630bd7bf905c48328d44e3a01fb13e36118c5bfbc94053be56cbb282cf17826f82d819aa2adff18c37ab8e7a91dde

  • SSDEEP

    12288:iWgL7QL3RwSkCT5Gxx9g/XwA+QTQQH1iaPbHiF3Z4mxxCskNPDRXLwHI:iX7QL3aCTYxx6RQQH1zCQmXCskZDRXLr

Score
10/10
modiloaderdefense_evasiondiscoverypersistencetrojan

Malware Config

Targets

    • Target

      9436f16cd747610be4d4f0f1b8d6461c_JaffaCakes118

    • Size

      886KB

    • MD5

      9436f16cd747610be4d4f0f1b8d6461c

    • SHA1

      d943722404f4616413d1bc7c7466e29c0670b78a

    • SHA256

      479c0addb9eac7d4f5db9df8932724c68b9edd07e3a62d3aac4692606d2266f7

    • SHA512

      9c1bdc6f1c9f6b2fd76655c344aa3f1720b630bd7bf905c48328d44e3a01fb13e36118c5bfbc94053be56cbb282cf17826f82d819aa2adff18c37ab8e7a91dde

    • SSDEEP

      12288:iWgL7QL3RwSkCT5Gxx9g/XwA+QTQQH1iaPbHiF3Z4mxxCskNPDRXLwHI:iX7QL3aCTYxx6RQQH1zCQmXCskZDRXLr

    Score
    10/10
    modiloaderdefense_evasiondiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks