modiloader | b01a47c8562851b30cca233f6124d279c20b4c93ef99a64eaa9b1824ae5ccc4f | Triage

Submit
Reports

Overview

overview

Static

static

b01a47c856...fN.exe

windows7-x64

b01a47c856...fN.exe

windows10-2004-x64

Sharing

General

Target

b01a47c8562851b30cca233f6124d279c20b4c93ef99a64eaa9b1824ae5ccc4fN.exe
Size

376KB
Sample

241218-hkt2faxqcw
MD5

f6c65d3d7783d6c6b21383e4ee50f6d0
SHA1

28f16d6c44991249b52af17e134649bfd1911ad6
SHA256

b01a47c8562851b30cca233f6124d279c20b4c93ef99a64eaa9b1824ae5ccc4f
SHA512

f9b5d9b1de92039f6c06994a7ac4dfaede3abf51e085fad07f52ae227910eab21e0e1c984812800debc90dccbd08698bb7c845c434a36a4766511173cc9bfa68
SSDEEP

6144:c9ctxJKFzDz8KFykipAjWnt7Q4VonPGgmFrrDciW1oreICFpz7K/obXko4:c6XKxYKBipBgBmFrrDcixeIkp6/GXko4

Score

10^/10

modiloader discovery persistence spyware stealer trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

b01a47c8562851b30cca233f6124d279c20b4c93ef99a64eaa9b1824ae5ccc4fN.exe

Resource

win7-20240903-en

modiloader discovery persistence spyware stealer trojan

windows7-x64

19 signatures

120 seconds

Behavioral task

behavioral2

Sample

b01a47c8562851b30cca233f6124d279c20b4c93ef99a64eaa9b1824ae5ccc4fN.exe

Resource

win10v2004-20241007-en

modiloader discovery persistence trojan

windows10-2004-x64

14 signatures

120 seconds

Malware Config

Targets

- Target
  
  b01a47c8562851b30cca233f6124d279c20b4c93ef99a64eaa9b1824ae5ccc4fN.exe
- Size
  
  376KB
- MD5
  
  f6c65d3d7783d6c6b21383e4ee50f6d0
- SHA1
  
  28f16d6c44991249b52af17e134649bfd1911ad6
- SHA256
  
  b01a47c8562851b30cca233f6124d279c20b4c93ef99a64eaa9b1824ae5ccc4f
- SHA512
  
  f9b5d9b1de92039f6c06994a7ac4dfaede3abf51e085fad07f52ae227910eab21e0e1c984812800debc90dccbd08698bb7c845c434a36a4766511173cc9bfa68
- SSDEEP
  
  6144:c9ctxJKFzDz8KFykipAjWnt7Q4VonPGgmFrrDciW1oreICFpz7K/obXko4:c6XKxYKBipBgBmFrrDcixeIkp6/GXko4
Score

10^/10

modiloader discovery persistence spyware stealer trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials in Registry

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoverypersistencespywarestealertrojan

behavioral2

modiloaderdiscoverypersistencetrojan

© 2018-2024

Terms | Privacy