General

  • Target

    a7e18c62ec283f926143c44c212782c9d83164c38a0ae3e8b0f5827893c06e25N.exe

  • Size

    326KB

  • Sample

    241231-c72rxatjct

  • MD5

    a169bc7115209e104478f529455cda50

  • SHA1

    d2d2debc4d9bfc2e6abb1d8a5c0adfb992050740

  • SHA256

    a7e18c62ec283f926143c44c212782c9d83164c38a0ae3e8b0f5827893c06e25

  • SHA512

    964cfe077b15f9b5b269e2a6934fda1591fa92509def381af9f58dc1fea29949cb50b328ab0bf271068f874d9c3c3f33f777c0d4ef74e286454d0852472cdefc

  • SSDEEP

    3072:ce2A0wxDqUpM5scww4chO+O1BmP5DG0sg3i4XZ9WvDZHwdRX/L+gP38XVF:csxD5cwohO+O1sVG0/pZ6iPC8e

Malware Config

Targets

    • Target

      a7e18c62ec283f926143c44c212782c9d83164c38a0ae3e8b0f5827893c06e25N.exe

    • Size

      326KB

    • MD5

      a169bc7115209e104478f529455cda50

    • SHA1

      d2d2debc4d9bfc2e6abb1d8a5c0adfb992050740

    • SHA256

      a7e18c62ec283f926143c44c212782c9d83164c38a0ae3e8b0f5827893c06e25

    • SHA512

      964cfe077b15f9b5b269e2a6934fda1591fa92509def381af9f58dc1fea29949cb50b328ab0bf271068f874d9c3c3f33f777c0d4ef74e286454d0852472cdefc

    • SSDEEP

      3072:ce2A0wxDqUpM5scww4chO+O1BmP5DG0sg3i4XZ9WvDZHwdRX/L+gP38XVF:csxD5cwohO+O1sVG0/pZ6iPC8e

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modiloader family

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks