Overview

overview

10

Static

static

5

9df5aa4449...39.exe

windows7-x64

10

9df5aa4449...39.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9df5aa44491489d1e47f15746089e6431442af9255bcebe3cb40f8bd7548ae39.exe

  • Size

    90KB

  • Sample

    241217-d2ssgszpcn

  • MD5

    6d0715d9d7521646be7eacfff0d377da

  • SHA1

    2d9fde068755b704d6687eb9fe3d0b157fabda87

  • SHA256

    9df5aa44491489d1e47f15746089e6431442af9255bcebe3cb40f8bd7548ae39

  • SHA512

    7998e4bf2e22b5512483fb28ae91b526e21b301ae507aedd3c4804b9e83a5c9623b01a354176ed98e9ddf2b56aede9061cbae4253df8e9df2954d9ccce2d6f39

  • SSDEEP

    1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDk:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3q

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      9df5aa44491489d1e47f15746089e6431442af9255bcebe3cb40f8bd7548ae39.exe

    • Size

      90KB

    • MD5

      6d0715d9d7521646be7eacfff0d377da

    • SHA1

      2d9fde068755b704d6687eb9fe3d0b157fabda87

    • SHA256

      9df5aa44491489d1e47f15746089e6431442af9255bcebe3cb40f8bd7548ae39

    • SHA512

      7998e4bf2e22b5512483fb28ae91b526e21b301ae507aedd3c4804b9e83a5c9623b01a354176ed98e9ddf2b56aede9061cbae4253df8e9df2954d9ccce2d6f39

    • SSDEEP

      1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDk:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3q

    Score
    10/10
    modiloaderdiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks