Overview

overview

10

Static

static

5

a059fb96e5...dd.exe

windows7-x64

10

a059fb96e5...dd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a059fb96e543c3bd5af48f915e6dd6d442637f1d27b45b6f75a0ba86e08bf9dd.exe

  • Size

    90KB

  • Sample

    250119-rmqw8s1kes

  • MD5

    9793381386531fdc7f821117999b6079

  • SHA1

    bde348d521247b8f3aad8ec52d87b937e53a8861

  • SHA256

    a059fb96e543c3bd5af48f915e6dd6d442637f1d27b45b6f75a0ba86e08bf9dd

  • SHA512

    d8878478b62da94b1528ad01a9a8311e83ce64f38d498af8704098508601064e29e5a0399f232a46aa8d90150f398389ab85b634a0be69bf41173a1a546ab7a9

  • SSDEEP

    1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oD0:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3u

Score
10/10
modiloaderdiscoverypersistencetrojanupx

Malware Config

Targets

    • Target

      a059fb96e543c3bd5af48f915e6dd6d442637f1d27b45b6f75a0ba86e08bf9dd.exe

    • Size

      90KB

    • MD5

      9793381386531fdc7f821117999b6079

    • SHA1

      bde348d521247b8f3aad8ec52d87b937e53a8861

    • SHA256

      a059fb96e543c3bd5af48f915e6dd6d442637f1d27b45b6f75a0ba86e08bf9dd

    • SHA512

      d8878478b62da94b1528ad01a9a8311e83ce64f38d498af8704098508601064e29e5a0399f232a46aa8d90150f398389ab85b634a0be69bf41173a1a546ab7a9

    • SSDEEP

      1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oD0:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3u

    Score
    10/10
    modiloaderdiscoverypersistencetrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks