Overview

overview

10

Static

static

10

9aaa4c1154...aN.exe

windows7-x64

10

9aaa4c1154...aN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9aaa4c1154d5017d1292ad167a09e9796a61c00b2601bd1cb8ab6edc235c0eaaN.exe

  • Size

    270KB

  • Sample

    241216-wwmcmaxphm

  • MD5

    7a515838637bf9d9c93fe72b276c5fd0

  • SHA1

    3d8804863c3d60d88b0ca1440f527be183a144f9

  • SHA256

    9aaa4c1154d5017d1292ad167a09e9796a61c00b2601bd1cb8ab6edc235c0eaa

  • SHA512

    fb2238a8ed9c9a45ddb753c3b7195f670008aac6864de73688c56d5b84d426740e16b38a17af843325884ca0fbcaee0b5608891c336fcfd6dfe83a939e8e223b

  • SSDEEP

    6144:KG377xS2Vp2CeiorXhwTBOz53ipcCJJvH:Zr7xS2Vp6FwTZbJJvH

Score
10/10
modiloaderdiscoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      9aaa4c1154d5017d1292ad167a09e9796a61c00b2601bd1cb8ab6edc235c0eaaN.exe

    • Size

      270KB

    • MD5

      7a515838637bf9d9c93fe72b276c5fd0

    • SHA1

      3d8804863c3d60d88b0ca1440f527be183a144f9

    • SHA256

      9aaa4c1154d5017d1292ad167a09e9796a61c00b2601bd1cb8ab6edc235c0eaa

    • SHA512

      fb2238a8ed9c9a45ddb753c3b7195f670008aac6864de73688c56d5b84d426740e16b38a17af843325884ca0fbcaee0b5608891c336fcfd6dfe83a939e8e223b

    • SSDEEP

      6144:KG377xS2Vp2CeiorXhwTBOz53ipcCJJvH:Zr7xS2Vp6FwTZbJJvH

    Score
    10/10
    modiloaderdiscoveryevasionpersistencetrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks