modiloader | f8748b6c94d99136e695f0cdb2c4e2e8f7c632edef4a129f3166bf018354a264 | Triage

Submit
Reports

Overview

overview

Static

static

5

f8748b6c94...64.exe

windows7-x64

f8748b6c94...64.exe

windows10-2004-x64

Sharing

General

Target

f8748b6c94d99136e695f0cdb2c4e2e8f7c632edef4a129f3166bf018354a264
Size

90KB
Sample

241228-e3748swjes
MD5

cf06b01884cc385a5052575d07145816
SHA1

52af8d0bfa381dffedc4bfd9c2755ba9bb12f19c
SHA256

f8748b6c94d99136e695f0cdb2c4e2e8f7c632edef4a129f3166bf018354a264
SHA512

48a600a2c16a5ba4d3e01d5f44758db8e6b0d1393eae2360f5a2a5eb042e1ad0c60539639f7a2bb64f87157894cb91f8e3c605a1bc6030cdbb28e3a8dc2c030a
SSDEEP

1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDu:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3o

Score

10^/10

modiloader discovery persistence trojan upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

f8748b6c94d99136e695f0cdb2c4e2e8f7c632edef4a129f3166bf018354a264.exe

Resource

win7-20240903-en

modiloader discovery persistence trojan upx

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

f8748b6c94d99136e695f0cdb2c4e2e8f7c632edef4a129f3166bf018354a264.exe

Resource

win10v2004-20241007-en

modiloader discovery persistence trojan upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  f8748b6c94d99136e695f0cdb2c4e2e8f7c632edef4a129f3166bf018354a264
- Size
  
  90KB
- MD5
  
  cf06b01884cc385a5052575d07145816
- SHA1
  
  52af8d0bfa381dffedc4bfd9c2755ba9bb12f19c
- SHA256
  
  f8748b6c94d99136e695f0cdb2c4e2e8f7c632edef4a129f3166bf018354a264
- SHA512
  
  48a600a2c16a5ba4d3e01d5f44758db8e6b0d1393eae2360f5a2a5eb042e1ad0c60539639f7a2bb64f87157894cb91f8e3c605a1bc6030cdbb28e3a8dc2c030a
- SSDEEP
  
  1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDu:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3o
Score

10^/10

modiloader discovery persistence trojan upx
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloaderdiscoverypersistencetrojanupx

behavioral2

modiloaderdiscoverypersistencetrojanupx

© 2018-2024

Terms | Privacy