General

  • Target

    ef8d841764d8712a0fe18729c4b1919a441da7422fdaf9f7d66623a3c7acbd1b

  • Size

    492KB

  • Sample

    221004-hqkpysgeb4

  • MD5

    0607e64873a5d5dcdf5f9eb539481828

  • SHA1

    3b9644db3e1c97e25ace970363d854a35a461679

  • SHA256

    ef8d841764d8712a0fe18729c4b1919a441da7422fdaf9f7d66623a3c7acbd1b

  • SHA512

    b242ba9e121d6479c7edf471e34008d51eabb4e71b828955fc9095631bb6940162be9ebdbd9264245aee02175be36320d85bf5dd1295e4af2d606f1b31fdc148

  • SSDEEP

    12288:HjuTkMa586N2rAs3e3D35UQpXyjWz8iu6pqXALLbr2U7QFxyzw:HsUNl6yD2KXYWzj3rZQFz

Malware Config

Targets

    • Target

      ef8d841764d8712a0fe18729c4b1919a441da7422fdaf9f7d66623a3c7acbd1b

    • Size

      492KB

    • MD5

      0607e64873a5d5dcdf5f9eb539481828

    • SHA1

      3b9644db3e1c97e25ace970363d854a35a461679

    • SHA256

      ef8d841764d8712a0fe18729c4b1919a441da7422fdaf9f7d66623a3c7acbd1b

    • SHA512

      b242ba9e121d6479c7edf471e34008d51eabb4e71b828955fc9095631bb6940162be9ebdbd9264245aee02175be36320d85bf5dd1295e4af2d606f1b31fdc148

    • SSDEEP

      12288:HjuTkMa586N2rAs3e3D35UQpXyjWz8iu6pqXALLbr2U7QFxyzw:HsUNl6yD2KXYWzj3rZQFz

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modifies visiblity of hidden/system files in Explorer

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

2
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Process Discovery

1
T1057

Tasks