Overview

overview

10

Static

static

3

e30c45beea...18.exe

windows7-x64

10

e30c45beea...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e30c45beea71d3cd5e8a328f1b31fcf0_JaffaCakes118

  • Size

    308KB

  • Sample

    241211-y1mv3axjdv

  • MD5

    e30c45beea71d3cd5e8a328f1b31fcf0

  • SHA1

    9f582648b3196d69d4b98734803ee4f185e67b45

  • SHA256

    f51eab6de9a0efc1b49d6a43a5a669918c7726f13eb7fd72e6c8746039f386e4

  • SHA512

    79eaaae566ac3ef1e04778d7ac187887d20ebf9e5a7517c8bc0245b84f39511c6f6c84c43eede8a8f1610dcd76a4604ec94790addf4406ca61878f7cb98116e1

  • SSDEEP

    6144:KOYjuXZYzrFb+eayeUtwrLsjV8i7GmjnZaAWrz5o+PwaTy3X:K51zrFb+eptXJjkAWrz5f323X

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      e30c45beea71d3cd5e8a328f1b31fcf0_JaffaCakes118

    • Size

      308KB

    • MD5

      e30c45beea71d3cd5e8a328f1b31fcf0

    • SHA1

      9f582648b3196d69d4b98734803ee4f185e67b45

    • SHA256

      f51eab6de9a0efc1b49d6a43a5a669918c7726f13eb7fd72e6c8746039f386e4

    • SHA512

      79eaaae566ac3ef1e04778d7ac187887d20ebf9e5a7517c8bc0245b84f39511c6f6c84c43eede8a8f1610dcd76a4604ec94790addf4406ca61878f7cb98116e1

    • SSDEEP

      6144:KOYjuXZYzrFb+eayeUtwrLsjV8i7GmjnZaAWrz5o+PwaTy3X:K51zrFb+eptXJjkAWrz5f323X

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks