Overview

overview

10

Static

static

10

acdd1a9be1...18.exe

windows7-x64

10

acdd1a9be1...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    acdd1a9be1cbaecbcb21cca0a413a023_JaffaCakes118

  • Size

    151KB

  • Sample

    241128-td51xaslat

  • MD5

    acdd1a9be1cbaecbcb21cca0a413a023

  • SHA1

    074a1bf23e1a6e453d07080561ae4c3c258961bb

  • SHA256

    61a36c20a49c1c43f12200afa67006a741ebfcf2917b1d5027729caa2b0ba125

  • SHA512

    8f19c229cd5e8d9b640cff258d2bb4d08cac86f81b77d7a2aff45604d168e96a014083dd937cd76ab407b59b0a739a2c3d31a0112df6b88d84c045a6d14968e5

  • SSDEEP

    3072:0VA+xbfCukKA0nTnXjj62f2rM4vks8nU3mhWlIj2Y/8Q:0BfCubnTXjj62b4v18UqwgX8Q

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      acdd1a9be1cbaecbcb21cca0a413a023_JaffaCakes118

    • Size

      151KB

    • MD5

      acdd1a9be1cbaecbcb21cca0a413a023

    • SHA1

      074a1bf23e1a6e453d07080561ae4c3c258961bb

    • SHA256

      61a36c20a49c1c43f12200afa67006a741ebfcf2917b1d5027729caa2b0ba125

    • SHA512

      8f19c229cd5e8d9b640cff258d2bb4d08cac86f81b77d7a2aff45604d168e96a014083dd937cd76ab407b59b0a739a2c3d31a0112df6b88d84c045a6d14968e5

    • SSDEEP

      3072:0VA+xbfCukKA0nTnXjj62f2rM4vks8nU3mhWlIj2Y/8Q:0BfCubnTXjj62b4v18UqwgX8Q

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies WinLogon for persistence

      persistence

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks