General

  • Target

    4b4f08315c7eb3c6f1c05d4bec31a7efa2b2c7675dc8e9eea82aa3eec6483ffe

  • Size

    492KB

  • Sample

    221004-hqn3dagffr

  • MD5

    4021a9e44eb14512367c1c3f2a56d4e5

  • SHA1

    0ef2e2e59237cc2d88c8085973a5f0f9a8a8ac1e

  • SHA256

    4b4f08315c7eb3c6f1c05d4bec31a7efa2b2c7675dc8e9eea82aa3eec6483ffe

  • SHA512

    39fc38df929f963f3d504c747095d8db2b13406e70a689225ec66cf2d1cc406fb3ae9b4b4dedc51f58b61687660de95db01f24e5074ef94cad7b733fd9f79dfe

  • SSDEEP

    12288:rjuTkMa586N2rAs3e3D35UQpXyjWz8iu6pqXALLbr2U7QFxyzw:rsUNl6yD2KXYWzj3rZQFz

Malware Config

Targets

    • Target

      4b4f08315c7eb3c6f1c05d4bec31a7efa2b2c7675dc8e9eea82aa3eec6483ffe

    • Size

      492KB

    • MD5

      4021a9e44eb14512367c1c3f2a56d4e5

    • SHA1

      0ef2e2e59237cc2d88c8085973a5f0f9a8a8ac1e

    • SHA256

      4b4f08315c7eb3c6f1c05d4bec31a7efa2b2c7675dc8e9eea82aa3eec6483ffe

    • SHA512

      39fc38df929f963f3d504c747095d8db2b13406e70a689225ec66cf2d1cc406fb3ae9b4b4dedc51f58b61687660de95db01f24e5074ef94cad7b733fd9f79dfe

    • SSDEEP

      12288:rjuTkMa586N2rAs3e3D35UQpXyjWz8iu6pqXALLbr2U7QFxyzw:rsUNl6yD2KXYWzj3rZQFz

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modifies visiblity of hidden/system files in Explorer

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

2
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Process Discovery

1
T1057

Tasks