Overview

overview

10

Static

static

3

e93527b115...18.exe

windows7-x64

10

e93527b115...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e93527b115490081dfd3c43ee722bfc7_JaffaCakes118

  • Size

    336KB

  • Sample

    240918-qktdxasfma

  • MD5

    e93527b115490081dfd3c43ee722bfc7

  • SHA1

    eb11f83e96fa0fb2a256152da5e2a0afa1f31916

  • SHA256

    bd8edf342ed7e098956be2b4869d4dbb74e4a99009298658a6eabed2173acef5

  • SHA512

    6db73a56551527024c5e195f1aadefdd53eba5973a57b116f9bb164d2d245cda18ea07f1a9f54ff18c57c2711c9b523c2f609db71ef57f3a795a63d7a0cdc983

  • SSDEEP

    6144:lDF+39NG7BBg5Qda8Xs3GghUB19c3txCLGWwJrvFdWbY4d0zHmnTXjj62b4v18Ui:tF+39NG7BBg5Qda8Xs2CgQ/0Gh9vFgbV

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      e93527b115490081dfd3c43ee722bfc7_JaffaCakes118

    • Size

      336KB

    • MD5

      e93527b115490081dfd3c43ee722bfc7

    • SHA1

      eb11f83e96fa0fb2a256152da5e2a0afa1f31916

    • SHA256

      bd8edf342ed7e098956be2b4869d4dbb74e4a99009298658a6eabed2173acef5

    • SHA512

      6db73a56551527024c5e195f1aadefdd53eba5973a57b116f9bb164d2d245cda18ea07f1a9f54ff18c57c2711c9b523c2f609db71ef57f3a795a63d7a0cdc983

    • SSDEEP

      6144:lDF+39NG7BBg5Qda8Xs3GghUB19c3txCLGWwJrvFdWbY4d0zHmnTXjj62b4v18Ui:tF+39NG7BBg5Qda8Xs2CgQ/0Gh9vFgbV

    Score
    10/10
    modiloaderdiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies WinLogon for persistence

      persistence

    • ModiLoader Second Stage

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks