General

  • Target

    Unconfirmed_175655.crdownload

  • Size

    377KB

  • Sample

    240628-zrswdsvdmp

  • MD5

    648f4f03a8972d907c18031a1f3181e9

  • SHA1

    369418d52aa47b0e9bf0b2f3ad3a8d057a86d82e

  • SHA256

    11144876769ba20e6e361575697502a98052b1f3cd510ba70eb6b75824e09adf

  • SHA512

    a04d20e9c1abbcf979eb9ed9485aa9362ff6175cdf298486bd031fbc629803ec625203545dd8f6c39219207af99400cc25e54e554191e3b98a1b0ee9b55e2f72

  • SSDEEP

    6144:GjOqZB1XdvAHUSb4P2wJVXvMKH/i7a6qiu8OQOIOiNexjS:GlDdYHUScpJVXUKH/iW1DBioe

Score
10/10

Malware Config

Targets

    • Target

      Unconfirmed_175655.crdownload

    • Size

      377KB

    • MD5

      648f4f03a8972d907c18031a1f3181e9

    • SHA1

      369418d52aa47b0e9bf0b2f3ad3a8d057a86d82e

    • SHA256

      11144876769ba20e6e361575697502a98052b1f3cd510ba70eb6b75824e09adf

    • SHA512

      a04d20e9c1abbcf979eb9ed9485aa9362ff6175cdf298486bd031fbc629803ec625203545dd8f6c39219207af99400cc25e54e554191e3b98a1b0ee9b55e2f72

    • SSDEEP

      6144:GjOqZB1XdvAHUSb4P2wJVXvMKH/i7a6qiu8OQOIOiNexjS:GlDdYHUScpJVXUKH/iW1DBioe

    Score
    10/10
    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks