General

  • Target

    2e05ab5dcd7e6089199427ad78b27ef2fc5006134358fb8d6de7fdee321c9b77N

  • Size

    90KB

  • Sample

    241106-1k3bxs1jcm

  • MD5

    8b248c6de8d9d46cea20532b8ade80f0

  • SHA1

    fcc4888946633f9afb9dfe6b825a0507ab08fdc7

  • SHA256

    2e05ab5dcd7e6089199427ad78b27ef2fc5006134358fb8d6de7fdee321c9b77

  • SHA512

    45a4f0699a2a6ef035f279b156b876ca44fb24f1adec283ee7c0eb6a14eafc0a0b53d4d8c2f914fcba0ebc08d2f8ca9fc4731b527dc2719a4ef8b9b2f396c856

  • SSDEEP

    1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y

Malware Config

Targets

    • Target

      2e05ab5dcd7e6089199427ad78b27ef2fc5006134358fb8d6de7fdee321c9b77N

    • Size

      90KB

    • MD5

      8b248c6de8d9d46cea20532b8ade80f0

    • SHA1

      fcc4888946633f9afb9dfe6b825a0507ab08fdc7

    • SHA256

      2e05ab5dcd7e6089199427ad78b27ef2fc5006134358fb8d6de7fdee321c9b77

    • SHA512

      45a4f0699a2a6ef035f279b156b876ca44fb24f1adec283ee7c0eb6a14eafc0a0b53d4d8c2f914fcba0ebc08d2f8ca9fc4731b527dc2719a4ef8b9b2f396c856

    • SSDEEP

      1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDK:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modiloader family

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks