General

  • Target

    091fbd8d1a58a54f7d71cb449a3da0ccd6a845950017209d88e25d7b685a1bb7

  • Size

    1MB

  • Sample

    231205-q8r6rabg46

  • MD5

    95af57a740c5db3e1e52cdb5355daa28

  • SHA1

    02fa230076b630be472086ffefa77a1a7a9a542c

  • SHA256

    091fbd8d1a58a54f7d71cb449a3da0ccd6a845950017209d88e25d7b685a1bb7

  • SHA512

    6fc5d5fb4274a262e0bec4306b67656ffe51020ce9902e1d8e9e979bf6d01dc4bb23cfa2a4fb8babea7b82709023b58a42e4461065b3244537471ed51da5ad71

  • SSDEEP

    49152:bee0SeGwcSGQ3OvlzgzRlyYFT9xZdmPSw:blMGNQ3ywXFJQ

Malware Config

Targets

    • Target

      091fbd8d1a58a54f7d71cb449a3da0ccd6a845950017209d88e25d7b685a1bb7

    • Size

      1MB

    • MD5

      95af57a740c5db3e1e52cdb5355daa28

    • SHA1

      02fa230076b630be472086ffefa77a1a7a9a542c

    • SHA256

      091fbd8d1a58a54f7d71cb449a3da0ccd6a845950017209d88e25d7b685a1bb7

    • SHA512

      6fc5d5fb4274a262e0bec4306b67656ffe51020ce9902e1d8e9e979bf6d01dc4bb23cfa2a4fb8babea7b82709023b58a42e4461065b3244537471ed51da5ad71

    • SSDEEP

      49152:bee0SeGwcSGQ3OvlzgzRlyYFT9xZdmPSw:blMGNQ3ywXFJQ

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • ModiLoader Second Stage

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Tasks