General
-
Target
5646ddce78f18a01104e3d979669826b6a480dd00067b359ea06590ecd259889.exe
-
Size
324KB
-
Sample
250116-p69gks1ngv
-
MD5
711ec6b819ec0fa11cec59003f147078
-
SHA1
55438a806c3ccc9d601c9ca017eee67b981716c6
-
SHA256
5646ddce78f18a01104e3d979669826b6a480dd00067b359ea06590ecd259889
-
SHA512
8180cf23100b2ff9a411964d208a4c37e617a0bd020c29ff7420667a18765e9b8301b5502f1a66e346830623bfcacbc136a70b358126cb1eb4e55d147b4056b1
-
SSDEEP
6144:QGyjnBSkuV1d4eZd88ORJIf/wTBt532GnhpcCO4oS0v6:bYnBSkuVUeZdYqwT77oSl
Behavioral task
behavioral1
Sample
5646ddce78f18a01104e3d979669826b6a480dd00067b359ea06590ecd259889.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
5646ddce78f18a01104e3d979669826b6a480dd00067b359ea06590ecd259889.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
5646ddce78f18a01104e3d979669826b6a480dd00067b359ea06590ecd259889.exe
-
Size
324KB
-
MD5
711ec6b819ec0fa11cec59003f147078
-
SHA1
55438a806c3ccc9d601c9ca017eee67b981716c6
-
SHA256
5646ddce78f18a01104e3d979669826b6a480dd00067b359ea06590ecd259889
-
SHA512
8180cf23100b2ff9a411964d208a4c37e617a0bd020c29ff7420667a18765e9b8301b5502f1a66e346830623bfcacbc136a70b358126cb1eb4e55d147b4056b1
-
SSDEEP
6144:QGyjnBSkuV1d4eZd88ORJIf/wTBt532GnhpcCO4oS0v6:bYnBSkuVUeZdYqwT77oSl
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3