General
-
Target
c7a61d3780094119f150f899c92f2b11b9e93863a754ff950ea68eab5954c7bb
-
Size
812KB
-
Sample
221201-wha3fade34
-
MD5
546e75ebe70aa7c62bb6461b0cad53cd
-
SHA1
7e1f3640e77d8184cb7d5930559050bcd5bca9de
-
SHA256
c7a61d3780094119f150f899c92f2b11b9e93863a754ff950ea68eab5954c7bb
-
SHA512
e12645c315394216d65b28535db3dbd3f3ad496771a2fa3d48c86e651d265e5deff4d915cb9233eaf0d50054146b502d55f53a7ebcb81cce11833ad224a627e0
-
SSDEEP
12288:4YknjLp+BNoLE126lU1tMGjYIFW4+zyZGumGgTtrDJrPsfL4oTO27uqULG1R:4Ykjl+r+8lUCpeZM3BDhPC5u/G
Behavioral task
behavioral1
Sample
c7a61d3780094119f150f899c92f2b11b9e93863a754ff950ea68eab5954c7bb.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c7a61d3780094119f150f899c92f2b11b9e93863a754ff950ea68eab5954c7bb.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
c7a61d3780094119f150f899c92f2b11b9e93863a754ff950ea68eab5954c7bb
-
Size
812KB
-
MD5
546e75ebe70aa7c62bb6461b0cad53cd
-
SHA1
7e1f3640e77d8184cb7d5930559050bcd5bca9de
-
SHA256
c7a61d3780094119f150f899c92f2b11b9e93863a754ff950ea68eab5954c7bb
-
SHA512
e12645c315394216d65b28535db3dbd3f3ad496771a2fa3d48c86e651d265e5deff4d915cb9233eaf0d50054146b502d55f53a7ebcb81cce11833ad224a627e0
-
SSDEEP
12288:4YknjLp+BNoLE126lU1tMGjYIFW4+zyZGumGgTtrDJrPsfL4oTO27uqULG1R:4Ykjl+r+8lUCpeZM3BDhPC5u/G
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies security service
-
Modifies visiblity of hidden/system files in Explorer
-
ModiLoader Second Stage
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-