Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2022 03:14
Behavioral task
behavioral1
Sample
97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe
Resource
win10v2004-20220901-en
General
-
Target
97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe
-
Size
313KB
-
MD5
5b2bb802d04de60d7a5f299d3de73fe2
-
SHA1
c226e881ee836218e34d33659c4263d5587ae852
-
SHA256
97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a
-
SHA512
4e989c453009ace4072fa48addb459fd4c0872fe9b3da110307c70728179e97d67dcc10d03406704bddc2590e98aa606e8470577174b282159ec53f06c40c438
-
SSDEEP
6144:EGyjnBSkuV1d4eZd88ORJIf/wTBt53rpcgHIxoS:/YnBSkuVUeZdYqwTZToxoS
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Processes:
97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe -
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3080-132-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3080-138-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 -
Processes:
resource yara_rule behavioral2/memory/3080-132-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3080-138-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exepid process 3080 97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe 3080 97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe 3080 97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe 3080 97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ 97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe" 97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe -
Processes:
97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exedescription pid process Token: SeDebugPrivilege 3080 97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe Token: SeDebugPrivilege 3080 97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exepid process 3080 97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe 3080 97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe"C:\Users\Admin\AppData\Local\Temp\97312815490f881dcde8f005651a90a16be0565b6d4265d4a74f3cff5672f45a.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cmsetac.dllFilesize
32KB
MD5792d93d7ef49f37c43ce41cd82240dcd
SHA104f0359a15a910d7853c1bfe54cfe0cb7375a227
SHA2567406f5c047dfcf23f568f7639ab92f6ad2f714fc928ad399dbfe9aea9effbe4f
SHA512d0aa52e19aad8eb614dfb0767f23cb82b67a9c3d0e38f4b4385b1ea4261f59511b203794106511e8bb6726ba73fdb3ca03a9cee3219df3b7da8e58a31aa9806a
-
C:\Users\Admin\AppData\Local\Temp\cmsetac.dllFilesize
32KB
MD5792d93d7ef49f37c43ce41cd82240dcd
SHA104f0359a15a910d7853c1bfe54cfe0cb7375a227
SHA2567406f5c047dfcf23f568f7639ab92f6ad2f714fc928ad399dbfe9aea9effbe4f
SHA512d0aa52e19aad8eb614dfb0767f23cb82b67a9c3d0e38f4b4385b1ea4261f59511b203794106511e8bb6726ba73fdb3ca03a9cee3219df3b7da8e58a31aa9806a
-
C:\Users\Admin\AppData\Local\Temp\ntdtcstp.dllFilesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
C:\Users\Admin\AppData\Local\Temp\ntdtcstp.dllFilesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
memory/3080-132-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/3080-138-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB