modiloader | d804fd595e9008d7b90bf18c2ce3680a5a7f9bd609629db3cb2dc602cd5c2cb4 | Triage

Sharing

General

Target

f3c5e2979473915ce47514b9a9a0991e_JaffaCakes118
Size

90KB
Sample

240924-q2j7ka1anc
MD5

f3c5e2979473915ce47514b9a9a0991e
SHA1

005501244bfe45e4a4f02ff5ca0dc2c728e56057
SHA256

d804fd595e9008d7b90bf18c2ce3680a5a7f9bd609629db3cb2dc602cd5c2cb4
SHA512

3a89c92f490141a058ea294e2457fe6f123fe525fd00b6effed87b3bd8bd62228c957c489c7e1117319820cb7347c02ed58cbed946823b3f41769a832f099488
SSDEEP

1536:C9Pcb2OD+70Q8kIlHEOkXGHOUkXdtg/WqrT7J1O1CX1XFfpup7c9ipR:gcb/D+bFgjkCX1VQRc8pR

Score

10^/10

modiloader discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  f3c5e2979473915ce47514b9a9a0991e_JaffaCakes118
- Size
  
  90KB
- MD5
  
  f3c5e2979473915ce47514b9a9a0991e
- SHA1
  
  005501244bfe45e4a4f02ff5ca0dc2c728e56057
- SHA256
  
  d804fd595e9008d7b90bf18c2ce3680a5a7f9bd609629db3cb2dc602cd5c2cb4
- SHA512
  
  3a89c92f490141a058ea294e2457fe6f123fe525fd00b6effed87b3bd8bd62228c957c489c7e1117319820cb7347c02ed58cbed946823b3f41769a832f099488
- SSDEEP
  
  1536:C9Pcb2OD+70Q8kIlHEOkXGHOUkXdtg/WqrT7J1O1CX1XFfpup7c9ipR:gcb/D+bFgjkCX1VQRc8pR
Score

10^/10

modiloader discovery evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modifies firewall policy service
  evasion
- ModiLoader Second Stage
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoveryevasionpersistencetrojan

behavioral2

modiloaderdiscoveryevasionpersistencetrojan