General

  • Target

    5063502552ac7f09e472be97a5d784b5e27f80f97ed3805e916b25d1054ec2b4

  • Size

    492KB

  • Sample

    221004-hqmjjsgffq

  • MD5

    31714e85b96cd7f689bbcdc8937b1b8c

  • SHA1

    a891fdd3968ac341231afaa0de0c87cfad82414e

  • SHA256

    5063502552ac7f09e472be97a5d784b5e27f80f97ed3805e916b25d1054ec2b4

  • SHA512

    1dde8cd77b9a0d951ecc226aa9383259ca8a7b8dc60ba7b68c3a29a2d216fb50132ddbcef2d41595fc3509340d5dbce8b3fca4c5aebedb4132b621f49a75da18

  • SSDEEP

    12288:2juTkMa586N2rAs3e3D35UQpXyjWz8iu6pqXALLbr2U7QFxyzw:2sUNl6yD2KXYWzj3rZQFz

Malware Config

Targets

    • Target

      5063502552ac7f09e472be97a5d784b5e27f80f97ed3805e916b25d1054ec2b4

    • Size

      492KB

    • MD5

      31714e85b96cd7f689bbcdc8937b1b8c

    • SHA1

      a891fdd3968ac341231afaa0de0c87cfad82414e

    • SHA256

      5063502552ac7f09e472be97a5d784b5e27f80f97ed3805e916b25d1054ec2b4

    • SHA512

      1dde8cd77b9a0d951ecc226aa9383259ca8a7b8dc60ba7b68c3a29a2d216fb50132ddbcef2d41595fc3509340d5dbce8b3fca4c5aebedb4132b621f49a75da18

    • SSDEEP

      12288:2juTkMa586N2rAs3e3D35UQpXyjWz8iu6pqXALLbr2U7QFxyzw:2sUNl6yD2KXYWzj3rZQFz

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modifies visiblity of hidden/system files in Explorer

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

2
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Process Discovery

1
T1057

Tasks