Overview

overview

10

Static

static

10

e4adc9bded...18.exe

windows7-x64

10

e4adc9bded...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e4adc9bdedc14771f3e5f037b848fbbc_JaffaCakes118

  • Size

    134KB

  • Sample

    240916-nngheavfpj

  • MD5

    e4adc9bdedc14771f3e5f037b848fbbc

  • SHA1

    0025965182d0e5221dd7e27872909506e1643ed6

  • SHA256

    8d549c8f68ba991d7b10dfc4b26878c2fb070c255fffc366e2f9340537c1bd61

  • SHA512

    7dbbc49342fe6562188cf718a4a6ca9db5ba363b5a6f881db2bae378303aa56e0c99982ad02d45689123703f782d0440267acf488a488c6be58dc8daadb026f8

  • SSDEEP

    1536:JYq/Qks19FWT6FnqRnsOpj7rTuAVmWlSYq/Qks19FWT6FnqRnsOpj7rTuAVmWlq:dqF3Ot6AVxoqF3Ot6AVxs

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      e4adc9bdedc14771f3e5f037b848fbbc_JaffaCakes118

    • Size

      134KB

    • MD5

      e4adc9bdedc14771f3e5f037b848fbbc

    • SHA1

      0025965182d0e5221dd7e27872909506e1643ed6

    • SHA256

      8d549c8f68ba991d7b10dfc4b26878c2fb070c255fffc366e2f9340537c1bd61

    • SHA512

      7dbbc49342fe6562188cf718a4a6ca9db5ba363b5a6f881db2bae378303aa56e0c99982ad02d45689123703f782d0440267acf488a488c6be58dc8daadb026f8

    • SSDEEP

      1536:JYq/Qks19FWT6FnqRnsOpj7rTuAVmWlSYq/Qks19FWT6FnqRnsOpj7rTuAVmWlq:dqF3Ot6AVxoqF3Ot6AVxs

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks