modiloader | d942d1b6773fb255f2cab884bf4271650642ba9bbbe8d246553957d1fc3c4e69 | Triage

Sharing

General

Target

f90999d31a642ab5ab465c7e1c661ef8_JaffaCakes118
Size

312KB
Sample

241217-11t1gszlc1
MD5

f90999d31a642ab5ab465c7e1c661ef8
SHA1

a2ab0236e781b5c6ecaf17f4836c1007911f9276
SHA256

d942d1b6773fb255f2cab884bf4271650642ba9bbbe8d246553957d1fc3c4e69
SHA512

9f0cca75d1cf7d08a030e8b7e270c30a015a4868a3e40a7299dd5ade9f7a05c77443184fc1da462b8ae809707eaaa4e7bcb02990ec51bd0178756246d9d4bfcf
SSDEEP

6144:DG377xS2Vp2CeiorXdwTBgWZ53V/ybLXpcCJJvH4:yr7xS2Vp6RwTys/ybLXbJJvH

Score

10^/10

modiloader discovery evasion persistence trojan

Malware Config

Targets

- Target
  
  f90999d31a642ab5ab465c7e1c661ef8_JaffaCakes118
- Size
  
  312KB
- MD5
  
  f90999d31a642ab5ab465c7e1c661ef8
- SHA1
  
  a2ab0236e781b5c6ecaf17f4836c1007911f9276
- SHA256
  
  d942d1b6773fb255f2cab884bf4271650642ba9bbbe8d246553957d1fc3c4e69
- SHA512
  
  9f0cca75d1cf7d08a030e8b7e270c30a015a4868a3e40a7299dd5ade9f7a05c77443184fc1da462b8ae809707eaaa4e7bcb02990ec51bd0178756246d9d4bfcf
- SSDEEP
  
  6144:DG377xS2Vp2CeiorXdwTBgWZ53V/ybLXpcCJJvH4:yr7xS2Vp6RwTys/ybLXbJJvH
Score

10^/10

modiloader discovery evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- UAC bypass
  evasion trojan
- ModiLoader Second Stage
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoveryevasionpersistencetrojan

behavioral2

modiloaderdiscoveryevasionpersistencetrojan