Overview

overview

10

Static

static

1

hesaphareketi01.cmd

windows7-x64

10

hesaphareketi01.cmd

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    hesaphareketi01.cmd

  • Size

    4.3MB

  • Sample

    240615-mt4dpa1erj

  • MD5

    a4be8d3b4bcc7db0198c4b47d86cce16

  • SHA1

    a18a8390e914debee1172c82e43c784f525009c7

  • SHA256

    6ff59a7a9bb26552d874bf03ffd04b7c152184e443d09f79a4f2459f8a04dd55

  • SHA512

    6cab41c6d7a72e08bb880311d3ec4996fe0cb265b5125e1b7eb451e11914644b2ef18487bacb607bb1eb9cdbb7c3f53bbb3ba403d6e961f9a5aa0cbb61aa12e1

  • SSDEEP

    24576:45Mrv/oEbMykRyeB182egMdyhXTKrXscV/bcsHuurHP0OSRB/KdHQO+j7G/0Rxa8:4KrDQy0P82syhXTdO/Q2BP05idd8dko

Score
10/10
modiloaderexecutionpersistencetrojan

Malware Config

Targets

    • Target

      hesaphareketi01.cmd

    • Size

      4.3MB

    • MD5

      a4be8d3b4bcc7db0198c4b47d86cce16

    • SHA1

      a18a8390e914debee1172c82e43c784f525009c7

    • SHA256

      6ff59a7a9bb26552d874bf03ffd04b7c152184e443d09f79a4f2459f8a04dd55

    • SHA512

      6cab41c6d7a72e08bb880311d3ec4996fe0cb265b5125e1b7eb451e11914644b2ef18487bacb607bb1eb9cdbb7c3f53bbb3ba403d6e961f9a5aa0cbb61aa12e1

    • SSDEEP

      24576:45Mrv/oEbMykRyeB182egMdyhXTKrXscV/bcsHuurHP0OSRB/KdHQO+j7G/0Rxa8:4KrDQy0P82syhXTdO/Q2BP05idd8dko

    Score
    10/10
    modiloadertrojanexecutionpersistence

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks