Overview

overview

10

Static

static

3

9292c01026...18.exe

windows7-x64

7

9292c01026...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9292c01026392c900b72e4bc543ee4d1_JaffaCakes118

  • Size

    84KB

  • Sample

    241124-e53brszqeq

  • MD5

    9292c01026392c900b72e4bc543ee4d1

  • SHA1

    76563158b9f884fad61632e8eb30b7063de4b467

  • SHA256

    d88d7e3bdaad0b97a1e7e139b464a5464ee28d5b70ebb055a4f5e12b18c6342c

  • SHA512

    bfe9047ae353f3f9696209897ab1b5d34d5faa1117cd50bddd144773fc13edd487add63a8f2d8c825fa2c0e846c8a4ff4c9616c6847d64b7cf978031966e0d5e

  • SSDEEP

    1536:N08QMDAozYeVWnJOz2Swc/KbCi7RTuEEfhxwzi3rIEzdnjuhbh:lDxWnJOz1GbCaTuEehxwzUrI6dnjuhbh

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      9292c01026392c900b72e4bc543ee4d1_JaffaCakes118

    • Size

      84KB

    • MD5

      9292c01026392c900b72e4bc543ee4d1

    • SHA1

      76563158b9f884fad61632e8eb30b7063de4b467

    • SHA256

      d88d7e3bdaad0b97a1e7e139b464a5464ee28d5b70ebb055a4f5e12b18c6342c

    • SHA512

      bfe9047ae353f3f9696209897ab1b5d34d5faa1117cd50bddd144773fc13edd487add63a8f2d8c825fa2c0e846c8a4ff4c9616c6847d64b7cf978031966e0d5e

    • SSDEEP

      1536:N08QMDAozYeVWnJOz2Swc/KbCi7RTuEEfhxwzi3rIEzdnjuhbh:lDxWnJOz1GbCaTuEehxwzUrI6dnjuhbh

    Score
    10/10
    discoverypersistencemodiloadertrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks