Overview

overview

10

Static

static

3

ddc1fb6f34...18.exe

windows7-x64

10

ddc1fb6f34...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ddc1fb6f34f31af70cb5fc800b456c13_JaffaCakes118

  • Size

    264KB

  • Sample

    241210-jtpczsvlan

  • MD5

    ddc1fb6f34f31af70cb5fc800b456c13

  • SHA1

    bbb258fcb2d8b38857b5231d1e0ebc36dd22ea47

  • SHA256

    2161bd42c12aae9b2847654c847150d613764aaac456b91377b6491750ad1afa

  • SHA512

    1877d94158eedb5809701339814b997fa82f20d56c0cba644f0fb18daabce3068fe2f6548df50af41e097078145cccd15a82c10730d210df455777a461279a14

  • SSDEEP

    6144:2Q8QlsQvnVwnMT1q2WUBts4GQAu1Ag735+nn60ZQE9Ti:OQlsinVwMTI0vs4Nmg1KZQ8T

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      ddc1fb6f34f31af70cb5fc800b456c13_JaffaCakes118

    • Size

      264KB

    • MD5

      ddc1fb6f34f31af70cb5fc800b456c13

    • SHA1

      bbb258fcb2d8b38857b5231d1e0ebc36dd22ea47

    • SHA256

      2161bd42c12aae9b2847654c847150d613764aaac456b91377b6491750ad1afa

    • SHA512

      1877d94158eedb5809701339814b997fa82f20d56c0cba644f0fb18daabce3068fe2f6548df50af41e097078145cccd15a82c10730d210df455777a461279a14

    • SSDEEP

      6144:2Q8QlsQvnVwnMT1q2WUBts4GQAu1Ag735+nn60ZQE9Ti:OQlsinVwMTI0vs4Nmg1KZQ8T

    Score
    10/10
    modiloaderdiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies WinLogon for persistence

      persistence

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks