General

  • Target

    8bd9f4402f6d6fce424b00d9ba58f199

  • Size

    894KB

  • Sample

    240203-j7261afcbl

  • MD5

    8bd9f4402f6d6fce424b00d9ba58f199

  • SHA1

    34f1216963afa798100917b203e1e0a6c09af1f0

  • SHA256

    b67c0a93586ce62991591c10cfcfb338b664ad4fd3b9aac496ef23728b7e2a4b

  • SHA512

    6e91038d3cf379f27ba352e9fe613b0ec64f504768391aca0a641fd90180d0d685ff09b24f4be929a5fb568b6a3ba64f4aa4c38b41035644f99cf659cf3f6a37

  • SSDEEP

    12288:Yxo7YNQg2YcKify3iTntxrr0cuUPnIpVwDIX9cgtWb2KExgDj48uSeJroREokzN:YKwQrsiK3Sr0ckHCb2Zxg348uS8ogzN

Malware Config

Targets

    • Target

      8bd9f4402f6d6fce424b00d9ba58f199

    • Size

      894KB

    • MD5

      8bd9f4402f6d6fce424b00d9ba58f199

    • SHA1

      34f1216963afa798100917b203e1e0a6c09af1f0

    • SHA256

      b67c0a93586ce62991591c10cfcfb338b664ad4fd3b9aac496ef23728b7e2a4b

    • SHA512

      6e91038d3cf379f27ba352e9fe613b0ec64f504768391aca0a641fd90180d0d685ff09b24f4be929a5fb568b6a3ba64f4aa4c38b41035644f99cf659cf3f6a37

    • SSDEEP

      12288:Yxo7YNQg2YcKify3iTntxrr0cuUPnIpVwDIX9cgtWb2KExgDj48uSeJroREokzN:YKwQrsiK3Sr0ckHCb2Zxg348uS8ogzN

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • UAC bypass

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks