Overview

overview

10

Static

static

7

e4145198cc...18.exe

windows7-x64

10

e4145198cc...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e4145198cc3116c674d58a8b211eeead_JaffaCakes118

  • Size

    654KB

  • Sample

    240916-fxbdrazhmm

  • MD5

    e4145198cc3116c674d58a8b211eeead

  • SHA1

    8d340e6473de888f36c4557045dccf7f0ebe82aa

  • SHA256

    fc910790f07561333855fba1520c2f622be8b436cfecb8ca5a710b5bef3acb97

  • SHA512

    1431ae810179a5268faffaf11ad942bf45e395cb5bc3e922b04aec9e474610498c464b173c99698c442fd26b8f05c3f27bdf0cf14821c69d06618b80e281e9a8

  • SSDEEP

    12288:NHLUMuiv9RgfSjAzRty9jpJCT1uxp62KW8CcCzyU56RZv+HFkZ4COy:1tAR2XCEv8W8CcQy2U1VZ4C

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      e4145198cc3116c674d58a8b211eeead_JaffaCakes118

    • Size

      654KB

    • MD5

      e4145198cc3116c674d58a8b211eeead

    • SHA1

      8d340e6473de888f36c4557045dccf7f0ebe82aa

    • SHA256

      fc910790f07561333855fba1520c2f622be8b436cfecb8ca5a710b5bef3acb97

    • SHA512

      1431ae810179a5268faffaf11ad942bf45e395cb5bc3e922b04aec9e474610498c464b173c99698c442fd26b8f05c3f27bdf0cf14821c69d06618b80e281e9a8

    • SSDEEP

      12288:NHLUMuiv9RgfSjAzRty9jpJCT1uxp62KW8CcCzyU56RZv+HFkZ4COy:1tAR2XCEv8W8CcQy2U1VZ4C

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks