General
-
Target
153df0b62b32abea05a68d9f9bdb1d0ceadd5fe04dd1334b7d6053afb67309feN.exe
-
Size
912KB
-
Sample
241125-syeh1stlcx
-
MD5
0564ba769d20df8f127c1f491e6a5540
-
SHA1
f4c47f8fd8a402bdd5c05aff882b1dace1633186
-
SHA256
153df0b62b32abea05a68d9f9bdb1d0ceadd5fe04dd1334b7d6053afb67309fe
-
SHA512
e6b3a837db38293ed6a4cca20af53a2cb0387af61945e9fdcf78da3ba2a8ffa47172ddff1fcf262d23812dc72205bd32156c46215d46a88525986f1afa317fee
-
SSDEEP
24576:ETzSqlFYcq/ZgmvTZ06L5+JYmm2gackH:ELTCvvt0g4JYNazH
Static task
static1
Behavioral task
behavioral1
Sample
153df0b62b32abea05a68d9f9bdb1d0ceadd5fe04dd1334b7d6053afb67309feN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
153df0b62b32abea05a68d9f9bdb1d0ceadd5fe04dd1334b7d6053afb67309feN.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
153df0b62b32abea05a68d9f9bdb1d0ceadd5fe04dd1334b7d6053afb67309feN.exe
-
Size
912KB
-
MD5
0564ba769d20df8f127c1f491e6a5540
-
SHA1
f4c47f8fd8a402bdd5c05aff882b1dace1633186
-
SHA256
153df0b62b32abea05a68d9f9bdb1d0ceadd5fe04dd1334b7d6053afb67309fe
-
SHA512
e6b3a837db38293ed6a4cca20af53a2cb0387af61945e9fdcf78da3ba2a8ffa47172ddff1fcf262d23812dc72205bd32156c46215d46a88525986f1afa317fee
-
SSDEEP
24576:ETzSqlFYcq/ZgmvTZ06L5+JYmm2gackH:ELTCvvt0g4JYNazH
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2