General
-
Target
Client.exe
-
Size
57KB
-
Sample
240627-ppv8matfjj
-
MD5
d5974fd7079170fcaae8d9f67871cfae
-
SHA1
c898165a5e5277acb909f5f83f50c218055c0a79
-
SHA256
0b3669c3b810dd0b3e04d0059885e4339ca5f152373f9516dd6d745cb5371a2b
-
SHA512
8151b6a0a040cf36005d00c26539115f41c07dc0ee713d08711f542bd96e5f78f7349f35352f859b7f621894e8dd23bb8d7a447871f6036a59f4dadb0721f1ba
-
SSDEEP
1536:E+mlvaVccBqyKeENPbr2oWfAoepo0OoL6TPfr:EvlaVccBgbr44o0OomrD
Behavioral task
behavioral1
Sample
Client.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
xworm
during-goto.gl.at.ply.gg:45478
-
install_file
USB.exe
Targets
-
-
Target
Client.exe
-
Size
57KB
-
MD5
d5974fd7079170fcaae8d9f67871cfae
-
SHA1
c898165a5e5277acb909f5f83f50c218055c0a79
-
SHA256
0b3669c3b810dd0b3e04d0059885e4339ca5f152373f9516dd6d745cb5371a2b
-
SHA512
8151b6a0a040cf36005d00c26539115f41c07dc0ee713d08711f542bd96e5f78f7349f35352f859b7f621894e8dd23bb8d7a447871f6036a59f4dadb0721f1ba
-
SSDEEP
1536:E+mlvaVccBqyKeENPbr2oWfAoepo0OoL6TPfr:EvlaVccBgbr44o0OomrD
-
Detect Neshta payload
-
Detect Xworm Payload
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
ModiLoader Second Stage
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Active Setup
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Active Setup
1Event Triggered Execution
1Change Default File Association
1