General

  • Target

    c779f6149a1d3b2d770ac40fc9b1b11c276d8feb327cd836c09b24f075900371

  • Size

    192KB

  • Sample

    221203-1k388acb2x

  • MD5

    a679a646763509ae2daebc558e7f7349

  • SHA1

    7847405318d77ed2ecc355af6d0afcd4f7edfc63

  • SHA256

    c779f6149a1d3b2d770ac40fc9b1b11c276d8feb327cd836c09b24f075900371

  • SHA512

    07d035509f6f0dd4b2e850caa4383b58bac198d9f3db3b78b023fc94641348a66aa86359c2da07b2059e7b71c4b13dadffcbd22f9a60defd88ae0a8e4a875060

  • SSDEEP

    3072:P+ZLGuZ4IXX0dt9KK0XRnBGD8socz9wsaNz9odTdsCVPZasGstlUJ6gu+FElNrMi:P+ouZ4MWt9KK6nyoc4zkTm+estlUsLk0

Malware Config

Targets

    • Target

      c779f6149a1d3b2d770ac40fc9b1b11c276d8feb327cd836c09b24f075900371

    • Size

      192KB

    • MD5

      a679a646763509ae2daebc558e7f7349

    • SHA1

      7847405318d77ed2ecc355af6d0afcd4f7edfc63

    • SHA256

      c779f6149a1d3b2d770ac40fc9b1b11c276d8feb327cd836c09b24f075900371

    • SHA512

      07d035509f6f0dd4b2e850caa4383b58bac198d9f3db3b78b023fc94641348a66aa86359c2da07b2059e7b71c4b13dadffcbd22f9a60defd88ae0a8e4a875060

    • SSDEEP

      3072:P+ZLGuZ4IXX0dt9KK0XRnBGD8socz9wsaNz9odTdsCVPZasGstlUJ6gu+FElNrMi:P+ouZ4MWt9KK6nyoc4zkTm+estlUsLk0

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • UAC bypass

    • ModiLoader Second Stage

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

3
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Tasks