General

  • Target

    abc.zip

  • Size

    982KB

  • Sample

    240325-hz3xwsde3x

  • MD5

    05b30e31b9d6598161b65ec941ea9fb3

  • SHA1

    fa1a780dc4521383c5efe41c6c323af62ed26f0e

  • SHA256

    5e6abb1d25e9523fc47f8a7149b663003b6eb3ac97889b9b8ba19f70c9028b2e

  • SHA512

    fc15842a346808587b9fe18165af57b5d3d3898f7982f9bbc10bfd8ceafd62dcaa271b1f6e8ea33484d949c8e7624621f8cfd4c8cb694516cdc2e36d0d25ff43

  • SSDEEP

    24576:tfarbaY4RwYkqrvvo/kaH0DJjZ7Z+7px0dJbthO:1aXmZvvosskjZN2px0bPO

Malware Config

Targets

    • Target

      abc.bat

    • Size

      3.3MB

    • MD5

      aa569c8d3f8bab9502a97a610d27729d

    • SHA1

      3727b1473dbca06ef346582d891c45b50e0fda67

    • SHA256

      88cf408569b4b2414b59abca6a662b338e7fdb0d702949643b2080bf60224998

    • SHA512

      5507a218283a81be1e963f5c8da196e6adaff1ee6e146a488200469428258ffd07e4e185584a35f65e17ce8208f3de6a5643398d25802b0a7edfc8a6586aea3b

    • SSDEEP

      49152:5KH9bAn8qkdEk/n3yLpKRYhEMfOGlhjFk99/:0

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks