General
- Target jaffacakes118__2d4b744f958ca3fefd6b1317ab539f02
- Size 740KB
- Sample260919-2casdaxeld
- SHA256 15845bf240787c30d840eea994074b5d5e6b27690e76e79a5febb4d17a2d0e0b
Score
10/10
Malware Config
Targets
-
- Target jaffacakes118__2d4b744f958ca3fefd6b1317ab539f02
- Size 740KB
- SHA256 15845bf240787c30d840eea994074b5d5e6b27690e76e79a5febb4d17a2d0e0b
Score10/10-
Family: ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
UAC bypass
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3