Overview

overview

10

Static

static

7

d6e93ad4f6...0N.exe

windows7-x64

10

d6e93ad4f6...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d6e93ad4f66323b71ff4b6e5fd3d6d30N

  • Size

    90KB

  • Sample

    240910-g9qjwa1hra

  • MD5

    d6e93ad4f66323b71ff4b6e5fd3d6d30

  • SHA1

    011f1fc2ff0e4dde5ead2d4f41d6d3e8af71df7b

  • SHA256

    ec725f3ffb6f6282d790fb6c760050eb6fec30f0df396c2c6cbc0e676bd9158a

  • SHA512

    cc8275beb812ba02c0a061cf72726907bf5b766f3dbcae6c987d8fbe426a34332bbd0153fcde15357286ad485d400b2147d73f2f15f2c176ace0019e3f8213d6

  • SSDEEP

    1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      d6e93ad4f66323b71ff4b6e5fd3d6d30N

    • Size

      90KB

    • MD5

      d6e93ad4f66323b71ff4b6e5fd3d6d30

    • SHA1

      011f1fc2ff0e4dde5ead2d4f41d6d3e8af71df7b

    • SHA256

      ec725f3ffb6f6282d790fb6c760050eb6fec30f0df396c2c6cbc0e676bd9158a

    • SHA512

      cc8275beb812ba02c0a061cf72726907bf5b766f3dbcae6c987d8fbe426a34332bbd0153fcde15357286ad485d400b2147d73f2f15f2c176ace0019e3f8213d6

    • SSDEEP

      1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y

    Score
    10/10
    modiloaderdiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks