Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://dld.standard...

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://dld.standard.us-east-1.oortech.com/Purchase%20Order%20PO1612%20%2C%20PO1613%20%2C%20PO1614%20%20MKS%20Instruments.xlsx.iso

  • Sample

    240820-ez314stbja

Score
10/10
modiloadercollectioncredential_accessdiscoverypersistencestealertrojan

Malware Config

Targets

    • Target

      https://dld.standard.us-east-1.oortech.com/Purchase%20Order%20PO1612%20%2C%20PO1613%20%2C%20PO1614%20%20MKS%20Instruments.xlsx.iso

    Score
    10/10
    modiloadercollectioncredential_accessdiscoverypersistencestealertrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks