Overview

overview

10

Static

static

7

d183527866...18.exe

windows7-x64

10

d183527866...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d183527866bece0882cf01d1868fcca1_JaffaCakes118

  • Size

    654KB

  • Sample

    240907-kgehpavcnj

  • MD5

    d183527866bece0882cf01d1868fcca1

  • SHA1

    5a3e30a950b27ecab79480ba874dc4ac4824bd85

  • SHA256

    451e829fd61d614568425ea22f06ea504b13b4471423e4248438a3c29a7db964

  • SHA512

    4e49a17444a1cfdf0c5b0dc27d1c583f732ae9c5b13a5cceab08900070169dba65b9215c07e314f181beb42a2b96e8bdcafefda470f0f60e37ea41aacd7e51da

  • SSDEEP

    12288:NHLUMuiv9RgfSjAzRty9jpJkT1uxp62KW8CcCzyU56RZv+HFkZRCOK:1tAR2XkEv8W8CcQy2U1VZR6

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      d183527866bece0882cf01d1868fcca1_JaffaCakes118

    • Size

      654KB

    • MD5

      d183527866bece0882cf01d1868fcca1

    • SHA1

      5a3e30a950b27ecab79480ba874dc4ac4824bd85

    • SHA256

      451e829fd61d614568425ea22f06ea504b13b4471423e4248438a3c29a7db964

    • SHA512

      4e49a17444a1cfdf0c5b0dc27d1c583f732ae9c5b13a5cceab08900070169dba65b9215c07e314f181beb42a2b96e8bdcafefda470f0f60e37ea41aacd7e51da

    • SSDEEP

      12288:NHLUMuiv9RgfSjAzRty9jpJkT1uxp62KW8CcCzyU56RZv+HFkZRCOK:1tAR2XkEv8W8CcQy2U1VZR6

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks