Overview

overview

10

Static

static

3

12ece402cf...fN.exe

windows7-x64

10

12ece402cf...fN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12ece402cfbe7280b637e6d9dc68c1e825198b72ffd01d46c555d6622a31c7dfN

  • Size

    112KB

  • Sample

    240921-q1lc8svenf

  • MD5

    5200251a95c0f7ac0e5e77546612f280

  • SHA1

    17adfa48a9d944066f213db2797151dcbdbd65fa

  • SHA256

    12ece402cfbe7280b637e6d9dc68c1e825198b72ffd01d46c555d6622a31c7df

  • SHA512

    278bc84b7b8a991d58ba2926adf1cf9a086c854c9b57af1faf8fe8dc5652da1a8a96369ae81271a61e415e764a484a203cf7b1f1c934a18219c9b1bc1c9f2191

  • SSDEEP

    1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      12ece402cfbe7280b637e6d9dc68c1e825198b72ffd01d46c555d6622a31c7dfN

    • Size

      112KB

    • MD5

      5200251a95c0f7ac0e5e77546612f280

    • SHA1

      17adfa48a9d944066f213db2797151dcbdbd65fa

    • SHA256

      12ece402cfbe7280b637e6d9dc68c1e825198b72ffd01d46c555d6622a31c7df

    • SHA512

      278bc84b7b8a991d58ba2926adf1cf9a086c854c9b57af1faf8fe8dc5652da1a8a96369ae81271a61e415e764a484a203cf7b1f1c934a18219c9b1bc1c9f2191

    • SSDEEP

      1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJ:tVIr7zI+fAceoGxSKKo5

    Score
    10/10
    modiloaderdiscoverytrojanupxpersistence

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks