Overview

overview

10

Static

static

3

fd6d713bc3...18.exe

windows7-x64

10

fd6d713bc3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fd6d713bc3aa9835bce0adeba5b01498_JaffaCakes118

  • Size

    892KB

  • Sample

    240929-ajtqaavfkb

  • MD5

    fd6d713bc3aa9835bce0adeba5b01498

  • SHA1

    dcb84ba266a2a5d37b97a4aa9710713fd48126d7

  • SHA256

    51a885b71726de417d0697f95da9157dada78d78f7c92e63e7743f9e1562fba7

  • SHA512

    1fdcddb240a377a088d486be0e22f451be0e27272b26aee5b1b34be1443b2d63fdc4ae45ac1070624ad69c9af94a3e993827670401d2c2b0b6a1235d679efb85

  • SSDEEP

    12288:Hmmo7YNQzGnBaWnBsPDqWOFqetuiaSwXb0lvIfU+5wOAjxAD+/ayqU9kEnhrgK05:GvwQyBaWnBCqyaaNCM2OAjxy+XjrnldA

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      fd6d713bc3aa9835bce0adeba5b01498_JaffaCakes118

    • Size

      892KB

    • MD5

      fd6d713bc3aa9835bce0adeba5b01498

    • SHA1

      dcb84ba266a2a5d37b97a4aa9710713fd48126d7

    • SHA256

      51a885b71726de417d0697f95da9157dada78d78f7c92e63e7743f9e1562fba7

    • SHA512

      1fdcddb240a377a088d486be0e22f451be0e27272b26aee5b1b34be1443b2d63fdc4ae45ac1070624ad69c9af94a3e993827670401d2c2b0b6a1235d679efb85

    • SSDEEP

      12288:Hmmo7YNQzGnBaWnBsPDqWOFqetuiaSwXb0lvIfU+5wOAjxAD+/ayqU9kEnhrgK05:GvwQyBaWnBCqyaaNCM2OAjxy+XjrnldA

    Score
    10/10
    modiloaderdiscoveryevasiontrojanpersistence

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks