General

  • Target

    13b3997048b8456c35b752b35e84b748930cec0a6157e635db78e99f0e8d199d

  • Size

    326KB

  • Sample

    240501-xllh1sdg8x

  • MD5

    7c913d55356b0cc422992f5b74733523

  • SHA1

    b85ba639999704d3e712a4f38fded2f2af7ba672

  • SHA256

    13b3997048b8456c35b752b35e84b748930cec0a6157e635db78e99f0e8d199d

  • SHA512

    5601bd4cccc69d57fc1249c09d45ebca285eb44d12d694bfa67901468f50b2ea56f3d72845681dbd6c4178984a71078cca4908fdf0404266b581b67259738d78

  • SSDEEP

    3072:Ie2A0wxDqUpM5scww4chO+O1BmP5DG0sg3i4XZ9WvDZHwdRX/L+gP38XV:IsxD5cwohO+O1sVG0/pZ6iPC8

Malware Config

Targets

    • Target

      13b3997048b8456c35b752b35e84b748930cec0a6157e635db78e99f0e8d199d

    • Size

      326KB

    • MD5

      7c913d55356b0cc422992f5b74733523

    • SHA1

      b85ba639999704d3e712a4f38fded2f2af7ba672

    • SHA256

      13b3997048b8456c35b752b35e84b748930cec0a6157e635db78e99f0e8d199d

    • SHA512

      5601bd4cccc69d57fc1249c09d45ebca285eb44d12d694bfa67901468f50b2ea56f3d72845681dbd6c4178984a71078cca4908fdf0404266b581b67259738d78

    • SSDEEP

      3072:Ie2A0wxDqUpM5scww4chO+O1BmP5DG0sg3i4XZ9WvDZHwdRX/L+gP38XV:IsxD5cwohO+O1sVG0/pZ6iPC8

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Detects Windows executables referencing non-Windows User-Agents

    • ModiLoader Second Stage

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks