Overview

overview

10

Static

static

10

e772ae616d...18.exe

windows7-x64

10

e772ae616d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e772ae616dc2f9bd72648a47c9b783a7_JaffaCakes118

  • Size

    270KB

  • Sample

    240917-w4q1saxhkp

  • MD5

    e772ae616dc2f9bd72648a47c9b783a7

  • SHA1

    8cfc5607731effe7766c4fb1e814a0a0671a507b

  • SHA256

    1fe56601638ce143d1c5b249da1ba2d0661978f2f49f91137d69bcbcefad83f9

  • SHA512

    a38a7346f08fbbe4a172ce5e5b8fc096edd15e0a15fb8b66fd56418ffda4601f049ce5201b2544ee575273d8dc37813de7d142c3956f1d3c0008116362c16e4b

  • SSDEEP

    6144:QG377xS2Vp2CeiorXdwTBgWx4v530pcCJJvHj:br7xS2Vp6RwTyCBbJJvHj

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      e772ae616dc2f9bd72648a47c9b783a7_JaffaCakes118

    • Size

      270KB

    • MD5

      e772ae616dc2f9bd72648a47c9b783a7

    • SHA1

      8cfc5607731effe7766c4fb1e814a0a0671a507b

    • SHA256

      1fe56601638ce143d1c5b249da1ba2d0661978f2f49f91137d69bcbcefad83f9

    • SHA512

      a38a7346f08fbbe4a172ce5e5b8fc096edd15e0a15fb8b66fd56418ffda4601f049ce5201b2544ee575273d8dc37813de7d142c3956f1d3c0008116362c16e4b

    • SSDEEP

      6144:QG377xS2Vp2CeiorXdwTBgWx4v530pcCJJvHj:br7xS2Vp6RwTyCBbJJvHj

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks