Overview

overview

10

Static

static

3

e0997e2159...18.exe

windows7-x64

10

e0997e2159...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e0997e2159345c338cee0cfea19a4ec4_JaffaCakes118

  • Size

    896KB

  • Sample

    241211-j8xb5svkcx

  • MD5

    e0997e2159345c338cee0cfea19a4ec4

  • SHA1

    2bbd35cfbd19253cc3de89cca49918b47c2db695

  • SHA256

    dd6570f2f96e3838cee770d424f6d6daee1f9dc5e490225b2f842dd1a89d7186

  • SHA512

    b88834e20636c8a6b01d4e85449c40360c0e8f44b24ec99a1d26d556a456a1fd71b09bdfe8fa668ee171bde81ba1e00380dc7ec122f6f4ad400a4ac3d701145c

  • SSDEEP

    12288:RJXN3tAT0dneSAfLVBIw7otR/SY0VCf0mm/Eggk0Cd7f:3XsmeSAf8Ee0mm/EgF0Kf

Score
10/10
modiloaderdiscoveryevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      e0997e2159345c338cee0cfea19a4ec4_JaffaCakes118

    • Size

      896KB

    • MD5

      e0997e2159345c338cee0cfea19a4ec4

    • SHA1

      2bbd35cfbd19253cc3de89cca49918b47c2db695

    • SHA256

      dd6570f2f96e3838cee770d424f6d6daee1f9dc5e490225b2f842dd1a89d7186

    • SHA512

      b88834e20636c8a6b01d4e85449c40360c0e8f44b24ec99a1d26d556a456a1fd71b09bdfe8fa668ee171bde81ba1e00380dc7ec122f6f4ad400a4ac3d701145c

    • SSDEEP

      12288:RJXN3tAT0dneSAfLVBIw7otR/SY0VCf0mm/Eggk0Cd7f:3XsmeSAf8Ee0mm/EgF0Kf

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks