Overview

overview

10

Static

static

5

9edd0a5c0e...4N.exe

windows7-x64

10

9edd0a5c0e...4N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9edd0a5c0e8ded4ad3be50ba116dfff6b0806979d89d747bf1ea9c78ba6a8eb4N.exe

  • Size

    90KB

  • Sample

    241226-psltcsvrfs

  • MD5

    c95f1bccf94d229c030204be0aed72f0

  • SHA1

    278f49c140df3108d55a9b99b71ece91658dd5a0

  • SHA256

    9edd0a5c0e8ded4ad3be50ba116dfff6b0806979d89d747bf1ea9c78ba6a8eb4

  • SHA512

    0e15da5e4deba8b6c34dcea051080c0b3978162690ca4fec5b5452282dd4d8bb69f301e4dead54ce21037ddcc3069bf55113578afbb3a33e36b1028156f9aa56

  • SSDEEP

    1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDs:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3m

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      9edd0a5c0e8ded4ad3be50ba116dfff6b0806979d89d747bf1ea9c78ba6a8eb4N.exe

    • Size

      90KB

    • MD5

      c95f1bccf94d229c030204be0aed72f0

    • SHA1

      278f49c140df3108d55a9b99b71ece91658dd5a0

    • SHA256

      9edd0a5c0e8ded4ad3be50ba116dfff6b0806979d89d747bf1ea9c78ba6a8eb4

    • SHA512

      0e15da5e4deba8b6c34dcea051080c0b3978162690ca4fec5b5452282dd4d8bb69f301e4dead54ce21037ddcc3069bf55113578afbb3a33e36b1028156f9aa56

    • SSDEEP

      1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDs:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3m

    Score
    10/10
    modiloaderdiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks