Analysis
-
max time kernel
187s -
max time network
198s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2022 01:22
Behavioral task
behavioral1
Sample
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe
Resource
win10v2004-20220721-en
General
-
Target
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe
-
Size
205KB
-
MD5
046a622e41c6d93a98a3478834bbe0b2
-
SHA1
1eb4e567adcb63e318057de1a07a6e5df22db0f7
-
SHA256
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83
-
SHA512
c95eeeaeea6e91c0f2dece089b139329978d266a860b6fd182fd3af3cb950bc712611b0ee81c2e4237eab9d9cfac2716dca9a2b8e63f490dffcfd985db9f20b1
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 9 IoCs
Processes:
resource yara_rule behavioral2/memory/4340-134-0x0000000000400000-0x0000000000478000-memory.dmp modiloader_stage2 behavioral2/memory/4340-135-0x0000000000400000-0x0000000000478000-memory.dmp modiloader_stage2 C:\Windows\mstwain32.exe modiloader_stage2 C:\Windows\mstwain32.exe modiloader_stage2 behavioral2/memory/4340-140-0x0000000000400000-0x0000000000478000-memory.dmp modiloader_stage2 C:\Windows\mstwain32.exe modiloader_stage2 behavioral2/memory/4796-145-0x0000000000400000-0x0000000000478000-memory.dmp modiloader_stage2 behavioral2/memory/4796-151-0x0000000000400000-0x0000000000478000-memory.dmp modiloader_stage2 behavioral2/memory/4796-152-0x0000000000400000-0x0000000000478000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
mstwain32.exemstwain32.exepid process 2820 mstwain32.exe 4796 mstwain32.exe -
Processes:
resource yara_rule behavioral2/memory/4340-131-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/4340-133-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/4340-134-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/4340-135-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/4340-140-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/4796-144-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/4796-145-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/4796-151-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/4796-152-0x0000000000400000-0x0000000000478000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe -
Loads dropped DLL 4 IoCs
Processes:
mstwain32.exepid process 4796 mstwain32.exe 4796 mstwain32.exe 4796 mstwain32.exe 4796 mstwain32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
mstwain32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ mstwain32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
Processes:
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exemstwain32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exemstwain32.exedescription pid process target process PID 4012 set thread context of 4340 4012 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe PID 2820 set thread context of 4796 2820 mstwain32.exe mstwain32.exe -
Drops file in Windows directory 4 IoCs
Processes:
mstwain32.exe5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exedescription ioc process File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe File created C:\Windows\mstwain32.exe 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe File opened for modification C:\Windows\mstwain32.exe 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exevssvc.exemstwain32.exedescription pid process Token: SeDebugPrivilege 4340 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe Token: SeBackupPrivilege 1052 vssvc.exe Token: SeRestorePrivilege 1052 vssvc.exe Token: SeAuditPrivilege 1052 vssvc.exe Token: SeDebugPrivilege 4796 mstwain32.exe Token: SeDebugPrivilege 4796 mstwain32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mstwain32.exepid process 4796 mstwain32.exe 4796 mstwain32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exemstwain32.exedescription pid process target process PID 4012 wrote to memory of 4340 4012 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe PID 4012 wrote to memory of 4340 4012 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe PID 4012 wrote to memory of 4340 4012 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe PID 4012 wrote to memory of 4340 4012 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe PID 4012 wrote to memory of 4340 4012 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe PID 4340 wrote to memory of 2820 4340 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe mstwain32.exe PID 4340 wrote to memory of 2820 4340 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe mstwain32.exe PID 4340 wrote to memory of 2820 4340 5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe mstwain32.exe PID 2820 wrote to memory of 4796 2820 mstwain32.exe mstwain32.exe PID 2820 wrote to memory of 4796 2820 mstwain32.exe mstwain32.exe PID 2820 wrote to memory of 4796 2820 mstwain32.exe mstwain32.exe PID 2820 wrote to memory of 4796 2820 mstwain32.exe mstwain32.exe PID 2820 wrote to memory of 4796 2820 mstwain32.exe mstwain32.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe"C:\Users\Admin\AppData\Local\Temp\5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exeC:\Users\Admin\AppData\Local\Temp\5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe2⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exeC:\Windows\mstwain32.exe \melt C:\Users\Admin\AppData\Local\Temp\5b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83.exe4⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\cmsetac.dllFilesize
33KB
MD51f4c86f1e92ab40f7d4c5f3e19047d3c
SHA17badc671fd7695d15390a6f7fffc0adfc31c8c0f
SHA256aab88e2393c78098f97b8cecd634080300d740678742f56e9722da1a5fdf22e1
SHA512d8867fdb8aff4b077896da3b0e6a88c9f6eca22df280a54d778904b5d43b10f1e0a072437bccb3a89a5034eda1c7f14bc2a9fd0a0a4a8e161b9e8634c01db23e
-
C:\Windows\cmsetac.dllFilesize
33KB
MD51f4c86f1e92ab40f7d4c5f3e19047d3c
SHA17badc671fd7695d15390a6f7fffc0adfc31c8c0f
SHA256aab88e2393c78098f97b8cecd634080300d740678742f56e9722da1a5fdf22e1
SHA512d8867fdb8aff4b077896da3b0e6a88c9f6eca22df280a54d778904b5d43b10f1e0a072437bccb3a89a5034eda1c7f14bc2a9fd0a0a4a8e161b9e8634c01db23e
-
C:\Windows\mstwain32.exeFilesize
205KB
MD5046a622e41c6d93a98a3478834bbe0b2
SHA11eb4e567adcb63e318057de1a07a6e5df22db0f7
SHA2565b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83
SHA512c95eeeaeea6e91c0f2dece089b139329978d266a860b6fd182fd3af3cb950bc712611b0ee81c2e4237eab9d9cfac2716dca9a2b8e63f490dffcfd985db9f20b1
-
C:\Windows\mstwain32.exeFilesize
205KB
MD5046a622e41c6d93a98a3478834bbe0b2
SHA11eb4e567adcb63e318057de1a07a6e5df22db0f7
SHA2565b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83
SHA512c95eeeaeea6e91c0f2dece089b139329978d266a860b6fd182fd3af3cb950bc712611b0ee81c2e4237eab9d9cfac2716dca9a2b8e63f490dffcfd985db9f20b1
-
C:\Windows\mstwain32.exeFilesize
205KB
MD5046a622e41c6d93a98a3478834bbe0b2
SHA11eb4e567adcb63e318057de1a07a6e5df22db0f7
SHA2565b05f07af95cd8ed7dcfc915bf955168ccb551e58df3b43342d5915e58185b83
SHA512c95eeeaeea6e91c0f2dece089b139329978d266a860b6fd182fd3af3cb950bc712611b0ee81c2e4237eab9d9cfac2716dca9a2b8e63f490dffcfd985db9f20b1
-
C:\Windows\ntdtcstp.dllFilesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
C:\Windows\ntdtcstp.dllFilesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
memory/2820-136-0x0000000000000000-mapping.dmp
-
memory/4340-140-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4340-130-0x0000000000000000-mapping.dmp
-
memory/4340-134-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4340-135-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4340-133-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4340-131-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4796-139-0x0000000000000000-mapping.dmp
-
memory/4796-144-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4796-145-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4796-150-0x00000000030B0000-0x00000000030BE000-memory.dmpFilesize
56KB
-
memory/4796-151-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4796-152-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB