Overview

overview

10

Static

static

3

ORDERREF47...CO.exe

windows7-x64

10

ORDERREF47...CO.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ORDERREF47806798PSMCO.exe

  • Size

    1.0MB

  • Sample

    241031-llzj4axlak

  • MD5

    0c30c6e44c595afef7d8e5209e6c21cd

  • SHA1

    9ad384a291bcb187a770826c9b4524ded9d4ce33

  • SHA256

    76af8cf5846c6addfc9049cde063bbee8c0353bc0870c5080ad37a41a9aab1a3

  • SHA512

    2ecd6746865cb88457f3e60445fbb5a790a9df84ca1d00acdd5124eea986e17e61d2dbe6b236d7b40691c7ff3a2f473508bb7b4299575b14b6124e64b905d543

  • SSDEEP

    24576:ZVb5KPAdOzVmG3zd+eIDT8Jf3pbV13Jks:ZVhOhd+eI8t5X

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      ORDERREF47806798PSMCO.exe

    • Size

      1.0MB

    • MD5

      0c30c6e44c595afef7d8e5209e6c21cd

    • SHA1

      9ad384a291bcb187a770826c9b4524ded9d4ce33

    • SHA256

      76af8cf5846c6addfc9049cde063bbee8c0353bc0870c5080ad37a41a9aab1a3

    • SHA512

      2ecd6746865cb88457f3e60445fbb5a790a9df84ca1d00acdd5124eea986e17e61d2dbe6b236d7b40691c7ff3a2f473508bb7b4299575b14b6124e64b905d543

    • SSDEEP

      24576:ZVb5KPAdOzVmG3zd+eIDT8Jf3pbV13Jks:ZVhOhd+eI8t5X

    Score
    10/10
    modiloaderdiscoverytrojanpersistence

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks