Overview

overview

10

Static

static

5

dee2e96dc5...98.exe

windows7-x64

10

dee2e96dc5...98.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dee2e96dc5afc4da657c5c2076a018434098f3871448b9fec55961587548cd98.exe

  • Size

    90KB

  • Sample

    241226-ngsxvstqgt

  • MD5

    deb850838f79c9e662a44a9f3031828e

  • SHA1

    3474fa220be5b9d802c7a18fd5a42bc55eba9fc4

  • SHA256

    dee2e96dc5afc4da657c5c2076a018434098f3871448b9fec55961587548cd98

  • SHA512

    90ab94a0e5a20a7d0f71e1ff3da64e301fd2bb7cf4e1718a7b1b5050e2e5519274becfa4298fc94ae55de75c5b35b2981d1abe4e4682449099e73424ebabe0e1

  • SSDEEP

    1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oD4:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3m

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      dee2e96dc5afc4da657c5c2076a018434098f3871448b9fec55961587548cd98.exe

    • Size

      90KB

    • MD5

      deb850838f79c9e662a44a9f3031828e

    • SHA1

      3474fa220be5b9d802c7a18fd5a42bc55eba9fc4

    • SHA256

      dee2e96dc5afc4da657c5c2076a018434098f3871448b9fec55961587548cd98

    • SHA512

      90ab94a0e5a20a7d0f71e1ff3da64e301fd2bb7cf4e1718a7b1b5050e2e5519274becfa4298fc94ae55de75c5b35b2981d1abe4e4682449099e73424ebabe0e1

    • SSDEEP

      1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oD4:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3m

    Score
    10/10
    modiloaderdiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks