Overview

overview

10

Static

static

3

171e2dad38...18.exe

windows7-x64

10

171e2dad38...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    171e2dad3855fe2eaf949bbcffca2b02_JaffaCakes118

  • Size

    536KB

  • Sample

    240627-xgdbvavejh

  • MD5

    171e2dad3855fe2eaf949bbcffca2b02

  • SHA1

    678e5e4f96ce90b9c3a998a4045369cacd360928

  • SHA256

    657b00d819cdcda652fa2a8df535d43c6a621d0204f91cbc5f7757bd10adf958

  • SHA512

    a4e9b462b93c1558ae7c3027094e2b4021d21aaaa13d03c91b073d68251e5cbad280c727df292abd7f44f177b74664952335f5885dba9900a4a0b6dfa2256ba2

  • SSDEEP

    12288:b1dlZo5yqnxw/AJ3EhpqSXbRzYhj10OsE90NL1v:b1dlZo5VnxkAJQhXVz4jzsE9OBv

Score
10/10
modiloaderevasiontrojanupx

Malware Config

Targets

    • Target

      171e2dad3855fe2eaf949bbcffca2b02_JaffaCakes118

    • Size

      536KB

    • MD5

      171e2dad3855fe2eaf949bbcffca2b02

    • SHA1

      678e5e4f96ce90b9c3a998a4045369cacd360928

    • SHA256

      657b00d819cdcda652fa2a8df535d43c6a621d0204f91cbc5f7757bd10adf958

    • SHA512

      a4e9b462b93c1558ae7c3027094e2b4021d21aaaa13d03c91b073d68251e5cbad280c727df292abd7f44f177b74664952335f5885dba9900a4a0b6dfa2256ba2

    • SSDEEP

      12288:b1dlZo5yqnxw/AJ3EhpqSXbRzYhj10OsE90NL1v:b1dlZo5VnxkAJQhXVz4jzsE9OBv

    Score
    10/10
    modiloaderevasiontrojanupx

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • UAC bypass

      evasiontrojan

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

5
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks