Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 01:56
Behavioral task
behavioral1
Sample
1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exe
Resource
win10v2004-20220812-en
General
-
Target
1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exe
-
Size
112KB
-
MD5
a27481c7aa6a4a71756015e84adda4ae
-
SHA1
80981525ce768485ae7f616b6872a150f399a9cb
-
SHA256
1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33
-
SHA512
0d418eb13a07e97fc628375a033574310548739525f6153a8955641da5bdf94f9d5dd1c672578a4afe84cbe27e7c7e7311494be34257d3d40d5a530749fb84fe
-
SSDEEP
3072:l1+MJKrUnFYY5z1i0Nmbi5fJBNILKAout:zIrPj0NmWtNILKAoS
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Processes:
1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exe -
ModiLoader Second Stage 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4792-137-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/4792-138-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 -
Processes:
resource yara_rule behavioral2/memory/4792-137-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/4792-138-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exepid process 4792 1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exe 4792 1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exe 4792 1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exe 4792 1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exe -
Processes:
1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exedescription pid process Token: SeDebugPrivilege 4792 1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exe Token: SeDebugPrivilege 4792 1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exepid process 4792 1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exe 4792 1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exe"C:\Users\Admin\AppData\Local\Temp\1729f798fe2756586ca03648cf16dd7309314e4749303edc602ab1aaa12e8e33.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4792
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cmsetac.dllFilesize
32KB
MD5120e760629644670f286d3ad101dd9fc
SHA15757324812c24548b9362112a8d94e66552af1a1
SHA25605e23e7c4558901a8f7c9aa9d6e2b2bd82402bf2e28e3862521b3260cf96ddf5
SHA512923a1e9126948bad1ea8f7fd97b79268c251c3b529bbe2d2a5d9a28ab5bc0504ba94e98bc5e640a71dfe6c7a38740c6be9a7533f9afc43f8ba095b4ded698c27
-
C:\Users\Admin\AppData\Local\Temp\cmsetac.dllFilesize
32KB
MD5120e760629644670f286d3ad101dd9fc
SHA15757324812c24548b9362112a8d94e66552af1a1
SHA25605e23e7c4558901a8f7c9aa9d6e2b2bd82402bf2e28e3862521b3260cf96ddf5
SHA512923a1e9126948bad1ea8f7fd97b79268c251c3b529bbe2d2a5d9a28ab5bc0504ba94e98bc5e640a71dfe6c7a38740c6be9a7533f9afc43f8ba095b4ded698c27
-
C:\Users\Admin\AppData\Local\Temp\ntdtcstp.dllFilesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
C:\Users\Admin\AppData\Local\Temp\ntdtcstp.dllFilesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
memory/4792-136-0x0000000002380000-0x000000000238E000-memory.dmpFilesize
56KB
-
memory/4792-137-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/4792-138-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB