General
-
Target
df9f252b2e59d97a272512ba43abb616
-
Size
667KB
-
Sample
240326-t57zksed65
-
MD5
df9f252b2e59d97a272512ba43abb616
-
SHA1
0909460414599f60c6b3b2ab4fa86d8efcafcf33
-
SHA256
e56c61fed6882bfa954c44abed50652788b9239e6017c703bda9c16eee5ee62f
-
SHA512
0aa61707046816ad83f06ec8ed087347dde4888c3343c53beefc2f57a50314ffb31ca3f5a4d8de1245d2eb2b71ba7cbfbb8c2a62683f347daa5664cd0db614ae
-
SSDEEP
12288:WbMqmEEEb4E9F/ATyGv4XKGQi2lJLm1Giizl6oAlpxElrW1A:WIeEEb4Ev/ATEXKGVnGTzpA1Ec1A
Behavioral task
behavioral1
Sample
df9f252b2e59d97a272512ba43abb616.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
df9f252b2e59d97a272512ba43abb616.exe
Resource
win10v2004-20240319-en
Malware Config
Targets
-
-
Target
df9f252b2e59d97a272512ba43abb616
-
Size
667KB
-
MD5
df9f252b2e59d97a272512ba43abb616
-
SHA1
0909460414599f60c6b3b2ab4fa86d8efcafcf33
-
SHA256
e56c61fed6882bfa954c44abed50652788b9239e6017c703bda9c16eee5ee62f
-
SHA512
0aa61707046816ad83f06ec8ed087347dde4888c3343c53beefc2f57a50314ffb31ca3f5a4d8de1245d2eb2b71ba7cbfbb8c2a62683f347daa5664cd0db614ae
-
SSDEEP
12288:WbMqmEEEb4E9F/ATyGv4XKGQi2lJLm1Giizl6oAlpxElrW1A:WIeEEb4Ev/ATEXKGVnGTzpA1Ec1A
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies security service
-
Modifies visiblity of hidden/system files in Explorer
-
ModiLoader Second Stage
-
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
6