Overview

overview

10

Static

static

5

fcf41b6e24...6N.exe

windows7-x64

10

fcf41b6e24...6N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fcf41b6e247941dc5aed7a5eaa55724e6dce8da691732acb7558ed4905021a86N.exe

  • Size

    90KB

  • Sample

    241217-rb8b5s1laz

  • MD5

    ed19ede9461d535085a959ae82df0fa0

  • SHA1

    2f6409d66045ab4525147c6c43400decfaa786b6

  • SHA256

    fcf41b6e247941dc5aed7a5eaa55724e6dce8da691732acb7558ed4905021a86

  • SHA512

    df262437062037d98474d440592fe6f9e2f15c77c1ec1f2e01ed252fd3354cd7ba9d7adf1a73936833679fc86e861171d35372b1c914b6c50c030c5b95e2d4b1

  • SSDEEP

    1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDS:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3E

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      fcf41b6e247941dc5aed7a5eaa55724e6dce8da691732acb7558ed4905021a86N.exe

    • Size

      90KB

    • MD5

      ed19ede9461d535085a959ae82df0fa0

    • SHA1

      2f6409d66045ab4525147c6c43400decfaa786b6

    • SHA256

      fcf41b6e247941dc5aed7a5eaa55724e6dce8da691732acb7558ed4905021a86

    • SHA512

      df262437062037d98474d440592fe6f9e2f15c77c1ec1f2e01ed252fd3354cd7ba9d7adf1a73936833679fc86e861171d35372b1c914b6c50c030c5b95e2d4b1

    • SSDEEP

      1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDS:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3E

    Score
    10/10
    modiloaderdiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks