General
-
Target
5c0524cad9409eef5a89f9f82b9dd281249c88fe8d8b502ff8fabd5f37dd242e
-
Size
308KB
-
Sample
220801-tcpbrsdbal
-
MD5
70dde31cdfe3210e787904ac2c1f2b1c
-
SHA1
eb05031c78188563cbf86e0081c30ddb7737bcf4
-
SHA256
5c0524cad9409eef5a89f9f82b9dd281249c88fe8d8b502ff8fabd5f37dd242e
-
SHA512
7353d75f3762e7fc0da20ed1317e27106e609ef715d478fabeeae147d6e0cdf066958689981bdcce6bc2802a68661feddebdb41187c3888053abd2a059d648c4
Static task
static1
Behavioral task
behavioral1
Sample
5c0524cad9409eef5a89f9f82b9dd281249c88fe8d8b502ff8fabd5f37dd242e.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5c0524cad9409eef5a89f9f82b9dd281249c88fe8d8b502ff8fabd5f37dd242e.exe
Resource
win10v2004-20220721-en
Malware Config
Targets
-
-
Target
5c0524cad9409eef5a89f9f82b9dd281249c88fe8d8b502ff8fabd5f37dd242e
-
Size
308KB
-
MD5
70dde31cdfe3210e787904ac2c1f2b1c
-
SHA1
eb05031c78188563cbf86e0081c30ddb7737bcf4
-
SHA256
5c0524cad9409eef5a89f9f82b9dd281249c88fe8d8b502ff8fabd5f37dd242e
-
SHA512
7353d75f3762e7fc0da20ed1317e27106e609ef715d478fabeeae147d6e0cdf066958689981bdcce6bc2802a68661feddebdb41187c3888053abd2a059d648c4
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-