modiloader | f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96 | Triage

Submit
Reports

Overview

overview

Static

static

5

f709c715dd...6N.exe

windows7-x64

f709c715dd...6N.exe

windows10-2004-x64

Sharing

General

Target

f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N
Size

90KB
Sample

241108-pdc8ns1na1
MD5

43e97117bfade5aa4c5614aaf9a7ad80
SHA1

42b98fea6bc225bb7941d49bcaf2fb23c8d83c3b
SHA256

f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96
SHA512

5a2009d430089fb8af7a1d7367c400a4a2ca092908e02b157d8bbf938a139e5c2b7e8b45ff0619da5c790b2285f69232889a2bb89dbffee97c1b178fab39f3ca
SSDEEP

1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y

Score

10^/10

modiloader discovery persistence trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe

Resource

win7-20241023-en

modiloader discovery persistence trojan upx

windows7-x64

13 signatures

120 seconds

Behavioral task

behavioral2

Sample

f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N.exe

Resource

win10v2004-20241007-en

modiloader discovery persistence trojan upx

windows10-2004-x64

13 signatures

120 seconds

Malware Config

Targets

- Target
  
  f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96N
- Size
  
  90KB
- MD5
  
  43e97117bfade5aa4c5614aaf9a7ad80
- SHA1
  
  42b98fea6bc225bb7941d49bcaf2fb23c8d83c3b
- SHA256
  
  f709c715dd07009d75294d96d28524ab7379553a76601ba6298246acb66ece96
- SHA512
  
  5a2009d430089fb8af7a1d7367c400a4a2ca092908e02b157d8bbf938a139e5c2b7e8b45ff0619da5c790b2285f69232889a2bb89dbffee97c1b178fab39f3ca
- SSDEEP
  
  1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Score

10^/10

modiloader discovery persistence trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoverypersistencetrojanupx

behavioral2

modiloaderdiscoverypersistencetrojanupx

© 2018-2024

Terms | Privacy