Overview

overview

10

Static

static

3

d54d81c094...18.exe

windows7-x64

10

d54d81c094...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d54d81c094ff7ffe62c2c68acf5141a0_JaffaCakes118

  • Size

    987KB

  • Sample

    240908-3pbe4stdrh

  • MD5

    d54d81c094ff7ffe62c2c68acf5141a0

  • SHA1

    c901d6093816c390b19e8c6bbf94ac769316eb13

  • SHA256

    13741ac044bd4cf21fbfc2c45cc30725fc2f0d8b613151ba88188b2ff0b8e722

  • SHA512

    dd33c5b4f5df2c654fc4599654549b1c3af4dd8b706e83d64490855a6ad309112436ae157cf9f6f5ac5b1d0eb6bd1f9e1e1095099b62d441e282e0184f7de256

  • SSDEEP

    24576:a0wwuFQZfpcYRz3J/Ae1a8LrEoGPnxp1mkl:XwwiOBFjjJGPngI

Score
10/10
modiloaderdefense_evasiondiscoveryevasiontrojan

Malware Config

Targets

    • Target

      d54d81c094ff7ffe62c2c68acf5141a0_JaffaCakes118

    • Size

      987KB

    • MD5

      d54d81c094ff7ffe62c2c68acf5141a0

    • SHA1

      c901d6093816c390b19e8c6bbf94ac769316eb13

    • SHA256

      13741ac044bd4cf21fbfc2c45cc30725fc2f0d8b613151ba88188b2ff0b8e722

    • SHA512

      dd33c5b4f5df2c654fc4599654549b1c3af4dd8b706e83d64490855a6ad309112436ae157cf9f6f5ac5b1d0eb6bd1f9e1e1095099b62d441e282e0184f7de256

    • SSDEEP

      24576:a0wwuFQZfpcYRz3J/Ae1a8LrEoGPnxp1mkl:XwwiOBFjjJGPngI

    Score
    10/10
    modiloaderdefense_evasiondiscoveryevasiontrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks