General
-
Target
8bd9f4402f6d6fce424b00d9ba58f199
-
Size
894KB
-
Sample
240203-j7261afcbl
-
MD5
8bd9f4402f6d6fce424b00d9ba58f199
-
SHA1
34f1216963afa798100917b203e1e0a6c09af1f0
-
SHA256
b67c0a93586ce62991591c10cfcfb338b664ad4fd3b9aac496ef23728b7e2a4b
-
SHA512
6e91038d3cf379f27ba352e9fe613b0ec64f504768391aca0a641fd90180d0d685ff09b24f4be929a5fb568b6a3ba64f4aa4c38b41035644f99cf659cf3f6a37
-
SSDEEP
12288:Yxo7YNQg2YcKify3iTntxrr0cuUPnIpVwDIX9cgtWb2KExgDj48uSeJroREokzN:YKwQrsiK3Sr0ckHCb2Zxg348uS8ogzN
Static task
static1
Behavioral task
behavioral1
Sample
8bd9f4402f6d6fce424b00d9ba58f199.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8bd9f4402f6d6fce424b00d9ba58f199.exe
Resource
win10v2004-20231215-en
Malware Config
Targets
-
-
Target
8bd9f4402f6d6fce424b00d9ba58f199
-
Size
894KB
-
MD5
8bd9f4402f6d6fce424b00d9ba58f199
-
SHA1
34f1216963afa798100917b203e1e0a6c09af1f0
-
SHA256
b67c0a93586ce62991591c10cfcfb338b664ad4fd3b9aac496ef23728b7e2a4b
-
SHA512
6e91038d3cf379f27ba352e9fe613b0ec64f504768391aca0a641fd90180d0d685ff09b24f4be929a5fb568b6a3ba64f4aa4c38b41035644f99cf659cf3f6a37
-
SSDEEP
12288:Yxo7YNQg2YcKify3iTntxrr0cuUPnIpVwDIX9cgtWb2KExgDj48uSeJroREokzN:YKwQrsiK3Sr0ckHCb2Zxg348uS8ogzN
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1