General
- Target jaffacakes118_ba5659d9ff07a71303d3cd354ab82f3edee17d5ffe38437b908f8aac4f416371.bin
- Size 270KB
- Sample260924-b1laxabd45
- SHA256 ba5659d9ff07a71303d3cd354ab82f3edee17d5ffe38437b908f8aac4f416371
Score
10/10
Malware Config
Targets
-
- Target jaffacakes118_ba5659d9ff07a71303d3cd354ab82f3edee17d5ffe38437b908f8aac4f416371.bin
- Size 270KB
- SHA256 ba5659d9ff07a71303d3cd354ab82f3edee17d5ffe38437b908f8aac4f416371
Score10/10-
Family: ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
UAC bypass
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2