Overview

overview

10

Static

static

3

d40480862f...18.exe

windows7-x64

10

d40480862f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d40480862f544ef81726411d1bdb81f4_JaffaCakes118

  • Size

    750KB

  • Sample

    241207-2tjfvaykcs

  • MD5

    d40480862f544ef81726411d1bdb81f4

  • SHA1

    c8b07741244a2bf9862c82fa4f3d9e42c5cea6b6

  • SHA256

    4cebb8f47d102f57151649966b7a8707f37dbab2a11c6508d55bf5d5bb68cb20

  • SHA512

    a15d5665b2156811cca5246cea98567ebf867b988ab6b2d02ed4f757d7a7317ebc4ce18125a0d6aac2e312d5c1889209f19a92fd762b9ce5b7d533cecc1b3d7b

  • SSDEEP

    12288:iR8u1CP68p5WfL7S+TlHXff3QaCY0gaY1hzLQxpULQZ+v0xnKJAkGeZlAYluLEMg:uvM68HoLW+TlHXff3QaCG7XqU6BnKJAI

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      d40480862f544ef81726411d1bdb81f4_JaffaCakes118

    • Size

      750KB

    • MD5

      d40480862f544ef81726411d1bdb81f4

    • SHA1

      c8b07741244a2bf9862c82fa4f3d9e42c5cea6b6

    • SHA256

      4cebb8f47d102f57151649966b7a8707f37dbab2a11c6508d55bf5d5bb68cb20

    • SHA512

      a15d5665b2156811cca5246cea98567ebf867b988ab6b2d02ed4f757d7a7317ebc4ce18125a0d6aac2e312d5c1889209f19a92fd762b9ce5b7d533cecc1b3d7b

    • SSDEEP

      12288:iR8u1CP68p5WfL7S+TlHXff3QaCY0gaY1hzLQxpULQZ+v0xnKJAkGeZlAYluLEMg:uvM68HoLW+TlHXff3QaCG7XqU6BnKJAI

    Score
    10/10
    modiloaderdiscoverypersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks