Overview

overview

10

Static

static

1

P1_2024_05...45.cmd

windows7-x64

10

P1_2024_05...45.cmd

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    P1_2024_056209_MQ04865_ENQ_1045.cmd

  • Size

    2.1MB

  • Sample

    241231-bkdacswrdk

  • MD5

    e74e6f735a0aabae7ea551ec00081be9

  • SHA1

    e21c6050c4b5598be0db7fff9abefdfcb8a78f04

  • SHA256

    e66a156bc6d1ef4b56a572c4133de2559388152dc36d1f35860e2defa566caaa

  • SHA512

    e26c43246087b24b40642f7fb412210a0cce295ce3009136d08596bcc644f74f4734e7f1375f2117d89a8935636d002d7b6c3065cd9aa2380a50c96d54c093c0

  • SSDEEP

    49152:W/UYHg0ZTx0dUH7eZArfNZ+k+lT+n++a++m+oj7+h+VLV++l++NGv++Ts+++ga+R:6

Score
10/10
modiloaderdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      P1_2024_056209_MQ04865_ENQ_1045.cmd

    • Size

      2.1MB

    • MD5

      e74e6f735a0aabae7ea551ec00081be9

    • SHA1

      e21c6050c4b5598be0db7fff9abefdfcb8a78f04

    • SHA256

      e66a156bc6d1ef4b56a572c4133de2559388152dc36d1f35860e2defa566caaa

    • SHA512

      e26c43246087b24b40642f7fb412210a0cce295ce3009136d08596bcc644f74f4734e7f1375f2117d89a8935636d002d7b6c3065cd9aa2380a50c96d54c093c0

    • SSDEEP

      49152:W/UYHg0ZTx0dUH7eZArfNZ+k+lT+n++a++m+oj7+h+VLV++l++NGv++Ts+++ga+R:6

    Score
    10/10
    modiloaderdiscoverytrojanpersistence

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks