Overview

overview

10

Static

static

10

b501ad5582...18.exe

windows7-x64

10

b501ad5582...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b501ad5582c63e939c1c6e1bfee44df0_JaffaCakes118

  • Size

    295KB

  • Sample

    240821-zpt1nsteql

  • MD5

    b501ad5582c63e939c1c6e1bfee44df0

  • SHA1

    c34105738d6b627d38f9a6e5f73831edd65cc54f

  • SHA256

    c37ec941d4b9ab830f01ac5f587ae6e4a8d1c24de83e8c2f8c6a75957fb07c40

  • SHA512

    b85c1a056b7d106d76003f54f4709007ae1ecacb87a1f3f6c8ebb4369211a4cef031acce4163bb9981ec49238b22a3812316761748236dc6d3d53a493542446c

  • SSDEEP

    6144:xG377xS2Vp2CeiorXdwTBgWx4bT01r53MpcCJJvHc:kr7xS2Vp6RwTyCIwobJJvHc

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      b501ad5582c63e939c1c6e1bfee44df0_JaffaCakes118

    • Size

      295KB

    • MD5

      b501ad5582c63e939c1c6e1bfee44df0

    • SHA1

      c34105738d6b627d38f9a6e5f73831edd65cc54f

    • SHA256

      c37ec941d4b9ab830f01ac5f587ae6e4a8d1c24de83e8c2f8c6a75957fb07c40

    • SHA512

      b85c1a056b7d106d76003f54f4709007ae1ecacb87a1f3f6c8ebb4369211a4cef031acce4163bb9981ec49238b22a3812316761748236dc6d3d53a493542446c

    • SSDEEP

      6144:xG377xS2Vp2CeiorXdwTBgWx4bT01r53MpcCJJvHc:kr7xS2Vp6RwTyCIwobJJvHc

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks