modiloader | e1a9f7fad02dc673f6c02f5b1ec82266dc85426941c403750d3c46289feec30c | Triage

Resubmissions

25-09-2024 17:02

240925-vj61tswglq 10

24-09-2024 10:56

240924-m1nltavhma 10

24-09-2024 10:31

240924-mkb8va1ejk 10

Sharing

General

Target

f37083d35c4d2e785a6fb84875cb8331_JaffaCakes118
Size

623KB
Sample

240925-vj61tswglq
MD5

f37083d35c4d2e785a6fb84875cb8331
SHA1

fc93143795ae3fb1b81947961d571b1e00fdb4b5
SHA256

e1a9f7fad02dc673f6c02f5b1ec82266dc85426941c403750d3c46289feec30c
SHA512

5d85335c80d532a22203076f5730ec8518b221f0a1ad89a14e7575a9d8d9b88d414afb72a5ea72a3bec728673d3db0b24cb597bb0da64ce4e03d6140bd602f51
SSDEEP

6144:zcP+pnEzMXdO4Qq6Iyh1G6J9bJuYK6wGWZRgdg18LIg7mG58Lxzj2z8ZkiGn1umM:zlnE/zJ9HKIww5AyviGumKuCN

Score

10^/10

modiloader bootkit defense_evasion discovery persistence trojan

Malware Config

Targets

- Target
  
  f37083d35c4d2e785a6fb84875cb8331_JaffaCakes118
- Size
  
  623KB
- MD5
  
  f37083d35c4d2e785a6fb84875cb8331
- SHA1
  
  fc93143795ae3fb1b81947961d571b1e00fdb4b5
- SHA256
  
  e1a9f7fad02dc673f6c02f5b1ec82266dc85426941c403750d3c46289feec30c
- SHA512
  
  5d85335c80d532a22203076f5730ec8518b221f0a1ad89a14e7575a9d8d9b88d414afb72a5ea72a3bec728673d3db0b24cb597bb0da64ce4e03d6140bd602f51
- SSDEEP
  
  6144:zcP+pnEzMXdO4Qq6Iyh1G6J9bJuYK6wGWZRgdg18LIg7mG58Lxzj2z8ZkiGn1umM:zlnE/zJ9HKIww5AyviGumKuCN
Score

10^/10

modiloader bootkit defense_evasion discovery persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- ModiLoader Second Stage
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Pre-OS Boot

Bootkit

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderbootkitdefense_evasiondiscoverypersistencetrojan