modiloader | 5774db473258bf744264a3a02e01931fa02ecd19a26f0f9329bfa5ac89d08512 | Triage

Submit
Reports

Overview

overview

Static

static

1

creatingbe...re.hta

windows10-2004-x64

Sharing

General

Target

creatingbestthingsforbetterfuture.hta
Size

13KB
Sample

250401-sp9b2atlw8
MD5

d784a93b62ff236f0090d49eee225f61
SHA1

18545dbd755b169d693a42c7e0ab32f4fd81aeaf
SHA256

5774db473258bf744264a3a02e01931fa02ecd19a26f0f9329bfa5ac89d08512
SHA512

3ca6164390caddbfe14bb3b50e690c08bd5e4df827b4a24e642b759c63cb375cf54ed9f3c9e9bd76c13075f149637034cee64039c9230bc100ba3016c42e73f0
SSDEEP

48:3StrVotriVRy1K+rUmn514Szy6oFAConovTboMrt2tgVJtSPG:AgrYmN514SyJF1onovTbDEGS+

Score

10^/10

modiloader collection defense_evasion discovery execution trojan

Static task

static1

Behavioral task

behavioral1

Sample

creatingbestthingsforbetterfuture.hta

Resource

win10v2004-20250314-en

modiloader collection defense_evasion discovery execution trojan

windows10-2004-x64

21 signatures

150 seconds

Malware Config

Targets

- Target
  
  creatingbestthingsforbetterfuture.hta
- Size
  
  13KB
- MD5
  
  d784a93b62ff236f0090d49eee225f61
- SHA1
  
  18545dbd755b169d693a42c7e0ab32f4fd81aeaf
- SHA256
  
  5774db473258bf744264a3a02e01931fa02ecd19a26f0f9329bfa5ac89d08512
- SHA512
  
  3ca6164390caddbfe14bb3b50e690c08bd5e4df827b4a24e642b759c63cb375cf54ed9f3c9e9bd76c13075f149637034cee64039c9230bc100ba3016c42e73f0
- SSDEEP
  
  48:3StrVotriVRy1K+rUmn514Szy6oFAConovTboMrt2tgVJtSPG:AgrYmN514SyJF1onovTbDEGS+
Score

10^/10

modiloader collection defense_evasion discovery execution trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Modiloader family
  modiloader
- ModiLoader Second Stage
- Blocklisted process makes network request
- Downloads MZ/PE file
- Evasion via Device Credential Deployment
  defense_evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

modiloadercollectiondefense_evasiondiscoveryexecutiontrojan

© 2018-2025

Terms | Privacy