General

  • Target

    8bd839bb3051d893a28adf398b2f02ed

  • Size

    1.3MB

  • Sample

    240203-j5mcrsfbfl

  • MD5

    8bd839bb3051d893a28adf398b2f02ed

  • SHA1

    4e15956dbc6b6b7c0579f12bf898197fca3c624c

  • SHA256

    a21b6bc32e6222626f92eb70daa868f878edf16f3ac8c5f42799589a6709975f

  • SHA512

    50fff0ce76d3f47d0d8a449e3f33c09d3fc1ac5d4e1530c8a3c4c4e96f9e8ce391c12cf7340c294ba82259268a0beb1aef4180e3efb42eebcc6c75be16af209f

  • SSDEEP

    24576:DuQT6N0EMNaGyDyj2KlPHD/loS1f4/tIfmhyoP4ntVq6eO6K5PuRt:DuQTgjLO35oXtI+hhYx5WRt

Malware Config

Targets

    • Target

      8bd839bb3051d893a28adf398b2f02ed

    • Size

      1.3MB

    • MD5

      8bd839bb3051d893a28adf398b2f02ed

    • SHA1

      4e15956dbc6b6b7c0579f12bf898197fca3c624c

    • SHA256

      a21b6bc32e6222626f92eb70daa868f878edf16f3ac8c5f42799589a6709975f

    • SHA512

      50fff0ce76d3f47d0d8a449e3f33c09d3fc1ac5d4e1530c8a3c4c4e96f9e8ce391c12cf7340c294ba82259268a0beb1aef4180e3efb42eebcc6c75be16af209f

    • SSDEEP

      24576:DuQT6N0EMNaGyDyj2KlPHD/loS1f4/tIfmhyoP4ntVq6eO6K5PuRt:DuQTgjLO35oXtI+hhYx5WRt

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • UAC bypass

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks