modiloader | 11144876769ba20e6e361575697502a98052b1f3cd510ba70eb6b75824e09adf

General

Target

648f4f03a8972d907c18031a1f3181e9.bin
Size

377KB
Sample

240630-crdp5ssdjh
MD5

648f4f03a8972d907c18031a1f3181e9
SHA1

369418d52aa47b0e9bf0b2f3ad3a8d057a86d82e
SHA256

11144876769ba20e6e361575697502a98052b1f3cd510ba70eb6b75824e09adf
SHA512

a04d20e9c1abbcf979eb9ed9485aa9362ff6175cdf298486bd031fbc629803ec625203545dd8f6c39219207af99400cc25e54e554191e3b98a1b0ee9b55e2f72
SSDEEP

6144:GjOqZB1XdvAHUSb4P2wJVXvMKH/i7a6qiu8OQOIOiNexjS:GlDdYHUScpJVXUKH/iW1DBioe

Score

10^/10

Malware Config

Targets

- Target
  
  648f4f03a8972d907c18031a1f3181e9.bin
- Size
  
  377KB
- MD5
  
  648f4f03a8972d907c18031a1f3181e9
- SHA1
  
  369418d52aa47b0e9bf0b2f3ad3a8d057a86d82e
- SHA256
  
  11144876769ba20e6e361575697502a98052b1f3cd510ba70eb6b75824e09adf
- SHA512
  
  a04d20e9c1abbcf979eb9ed9485aa9362ff6175cdf298486bd031fbc629803ec625203545dd8f6c39219207af99400cc25e54e554191e3b98a1b0ee9b55e2f72
- SSDEEP
  
  6144:GjOqZB1XdvAHUSb4P2wJVXvMKH/i7a6qiu8OQOIOiNexjS:GlDdYHUScpJVXUKH/iW1DBioe
Score

10^/10

modiloader evasion persistence trojan
- ModiLoader, DBatLoader
  ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
  trojan modiloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VirtualBox drivers on disk
  evasion
- ModiLoader Second Stage
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Adds Run key to start application
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Targets

ModiLoader, DBatLoader

Process spawned unexpected child process

Checks for common network interception software

Looks for VirtualBox Guest Additions in registry

Looks for VirtualBox drivers on disk

ModiLoader Second Stage

Looks for VMWare Tools registry key

Checks BIOS information in registry

Checks computer location settings

Deletes itself

Drops startup file

Adds Run key to start application

Maps connected drives based on registry

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2