Overview

overview

10

Static

static

4

greatindia...ns.hta

windows7-x64

10

greatindia...ns.hta

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta

  • Size

    144KB

  • Sample

    241218-qsx23a1jas

  • MD5

    5590c12b4f62de6de143d675d7681db0

  • SHA1

    e7f0a97a22c0c11336e1cbc37fee2e31adbf01ee

  • SHA256

    3057554d997baa307152ad177f47430aa1b8748f2021c8080cc6876016829b23

  • SHA512

    eb62448a56f6de94d8671c7bb6d882c56d802afbfbb49baa22cea344991736e34e320f9a0786397bffaf43afae6b7ac77f05ab29218a04e9ec68dd2eea37f891

  • SSDEEP

    768:t1EHfLum2oum2J5KUJDVUKhC74GVf/Aq2v9PV8aQP2eLPyqv6vRc6cfzqfz4Asfc:tz

Score
10/10
modiloaderdefense_evasiondiscoveryexecutionpersistencephishingtrojan

Malware Config

Targets

    • Target

      greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta

    • Size

      144KB

    • MD5

      5590c12b4f62de6de143d675d7681db0

    • SHA1

      e7f0a97a22c0c11336e1cbc37fee2e31adbf01ee

    • SHA256

      3057554d997baa307152ad177f47430aa1b8748f2021c8080cc6876016829b23

    • SHA512

      eb62448a56f6de94d8671c7bb6d882c56d802afbfbb49baa22cea344991736e34e320f9a0786397bffaf43afae6b7ac77f05ab29218a04e9ec68dd2eea37f891

    • SSDEEP

      768:t1EHfLum2oum2J5KUJDVUKhC74GVf/Aq2v9PV8aQP2eLPyqv6vRc6cfzqfz4Asfc:tz

    Score
    10/10
    modiloaderdefense_evasiondiscoveryexecutiontrojanpersistence

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Evasion via Device Credential Deployment

      defense_evasionexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks