Overview

overview

10

Static

static

3

3baf447ff4...eN.exe

windows7-x64

10

3baf447ff4...eN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3baf447ff4826e41ee5ddf50f9d48b2024d6855b66adc9f25acc11eab67b38eeN.exe

  • Size

    112KB

  • Sample

    241217-14wngszmgy

  • MD5

    4adcce9fc955ae3393386427c85a4a80

  • SHA1

    1d754f06869f3a26f6a6ff14990b76691216355b

  • SHA256

    3baf447ff4826e41ee5ddf50f9d48b2024d6855b66adc9f25acc11eab67b38ee

  • SHA512

    b972897c939b22ec4d2a30699a14bb715872ecf3de457740dfe1597ed510cb0e3abc27b63b0fade77987826538da00850c32bce523bc044d01113567579d2b70

  • SSDEEP

    1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJg:tVIr7zI+fAceoGxSKKo5g

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      3baf447ff4826e41ee5ddf50f9d48b2024d6855b66adc9f25acc11eab67b38eeN.exe

    • Size

      112KB

    • MD5

      4adcce9fc955ae3393386427c85a4a80

    • SHA1

      1d754f06869f3a26f6a6ff14990b76691216355b

    • SHA256

      3baf447ff4826e41ee5ddf50f9d48b2024d6855b66adc9f25acc11eab67b38ee

    • SHA512

      b972897c939b22ec4d2a30699a14bb715872ecf3de457740dfe1597ed510cb0e3abc27b63b0fade77987826538da00850c32bce523bc044d01113567579d2b70

    • SSDEEP

      1536:t2ovIa47CqIf2f3w41p7sDcX7juR/JSJw8EeNshUDGXJg:tVIr7zI+fAceoGxSKKo5g

    Score
    10/10
    modiloaderdiscoverytrojanupxpersistence

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks