General
-
Target
DOC.09323872637283.zip
-
Size
556KB
-
Sample
230526-ntewrsfc37
-
MD5
8dcab93f2fb05029c604a6c0f9e27f49
-
SHA1
b85ef06f45ed4091d2a780384943aae009933342
-
SHA256
1be5998378ab64533d717ffaf0f10d892e1790f260f72060ad1318e4d6d4321b
-
SHA512
5dbcdfdf0ef5a35f5e5b77c5403c1f81ce0cd6c6a98ffd82143dbc125084cc4d31a6a2461c0f201e2845a78836683ab5d33bcfac0a35d69c2a0698b1faf5664d
-
SSDEEP
12288:Fc2Nk+dPo0BDOB50StYla3fSNuydCYuJj:FZNJ1On0paPkLCNJj
Static task
static1
Behavioral task
behavioral1
Sample
DOC.09323872637283.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
DOC.09323872637283.exe
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
DOC.09323872637283.exe
-
Size
1.0MB
-
MD5
33d0315e844e991a28980ad8a108a423
-
SHA1
2c91f349e52c5995bfb81d309392b119d5954996
-
SHA256
3d3106d56edd0d99fb92516b4ab21f27972e104477204343c5f365aa604650ef
-
SHA512
c9639414395d4177b5fd52f3190d5d9e17d31678f815f1e61176c17b87d33dfef70830a0055bd97966a10ee822a59c0a0d55ebed32348067422ab7de1bc8e239
-
SSDEEP
24576:SSWrMz8C3kJ+VnkaJ56TxIN84Mm/3vfb5GJ:SS0o8YXMFIN84X3vfb5W
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-