Analysis
-
max time kernel
150s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 12:45
Static task
static1
Behavioral task
behavioral1
Sample
59f4e4afb1ae84ff796cf98b8f2c8647f7252fc7ffd0e461197b7d6d944f75f1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
59f4e4afb1ae84ff796cf98b8f2c8647f7252fc7ffd0e461197b7d6d944f75f1.exe
Resource
win10v2004-20220812-en
General
-
Target
59f4e4afb1ae84ff796cf98b8f2c8647f7252fc7ffd0e461197b7d6d944f75f1.exe
-
Size
1.2MB
-
MD5
75bec87a8dc506914d536a117fb9c6f8
-
SHA1
239e218830911e7e8513886e465eeee966671919
-
SHA256
59f4e4afb1ae84ff796cf98b8f2c8647f7252fc7ffd0e461197b7d6d944f75f1
-
SHA512
0e07a62f20dfcb8b3ad1b52c5901d963edcde45022bbcef75ce2fb2c7f1822b6f02f8b189909b5f2f466f02534346daa9ad88829af0310ecc91b2d9ce814cadd
-
SSDEEP
24576:LxBgcKNYRmJkcoQricOIQxiZY1iawTB/PPfNW:LTKTJZoQrbTFZY1iawxVW
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 15 IoCs
Processes:
resource yara_rule behavioral1/memory/1116-67-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1116-69-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1116-71-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1116-72-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1116-74-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1116-79-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1116-77-0x0000000000430464-mapping.dmp modiloader_stage2 behavioral1/memory/1116-76-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1116-81-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1116-82-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/1116-88-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/880-102-0x0000000000430464-mapping.dmp modiloader_stage2 behavioral1/memory/880-106-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/880-108-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral1/memory/880-110-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 -
Executes dropped EXE 4 IoCs
Processes:
binipeladokkkk.exebinipeladokkkk.exemstwain32.exemstwain32.exepid process 1096 binipeladokkkk.exe 1116 binipeladokkkk.exe 1060 mstwain32.exe 880 mstwain32.exe -
Loads dropped DLL 2 IoCs
Processes:
59f4e4afb1ae84ff796cf98b8f2c8647f7252fc7ffd0e461197b7d6d944f75f1.exebinipeladokkkk.exepid process 1452 59f4e4afb1ae84ff796cf98b8f2c8647f7252fc7ffd0e461197b7d6d944f75f1.exe 1096 binipeladokkkk.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
mstwain32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ mstwain32.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
Processes:
binipeladokkkk.exemstwain32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA binipeladokkkk.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
AutoIT Executable 8 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\binipeladokkkk.exe autoit_exe C:\Users\Admin\AppData\Local\Temp\binipeladokkkk.exe autoit_exe C:\Users\Admin\AppData\Local\Temp\binipeladokkkk.exe autoit_exe \Users\Admin\AppData\Local\Temp\binipeladokkkk.exe autoit_exe C:\Users\Admin\AppData\Local\Temp\binipeladokkkk.exe autoit_exe C:\Windows\mstwain32.exe autoit_exe C:\Windows\mstwain32.exe autoit_exe C:\Windows\mstwain32.exe autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
binipeladokkkk.exemstwain32.exedescription pid process target process PID 1096 set thread context of 1116 1096 binipeladokkkk.exe binipeladokkkk.exe PID 1060 set thread context of 880 1060 mstwain32.exe mstwain32.exe -
Drops file in Windows directory 4 IoCs
Processes:
binipeladokkkk.exemstwain32.exedescription ioc process File created C:\Windows\mstwain32.exe binipeladokkkk.exe File opened for modification C:\Windows\mstwain32.exe binipeladokkkk.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
binipeladokkkk.exevssvc.exemstwain32.exedescription pid process Token: SeDebugPrivilege 1116 binipeladokkkk.exe Token: SeBackupPrivilege 968 vssvc.exe Token: SeRestorePrivilege 968 vssvc.exe Token: SeAuditPrivilege 968 vssvc.exe Token: SeDebugPrivilege 880 mstwain32.exe Token: SeDebugPrivilege 880 mstwain32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 1572 DllHost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
59f4e4afb1ae84ff796cf98b8f2c8647f7252fc7ffd0e461197b7d6d944f75f1.exemstwain32.exepid process 1452 59f4e4afb1ae84ff796cf98b8f2c8647f7252fc7ffd0e461197b7d6d944f75f1.exe 880 mstwain32.exe 880 mstwain32.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
59f4e4afb1ae84ff796cf98b8f2c8647f7252fc7ffd0e461197b7d6d944f75f1.exebinipeladokkkk.exebinipeladokkkk.exemstwain32.exedescription pid process target process PID 1452 wrote to memory of 1096 1452 59f4e4afb1ae84ff796cf98b8f2c8647f7252fc7ffd0e461197b7d6d944f75f1.exe binipeladokkkk.exe PID 1452 wrote to memory of 1096 1452 59f4e4afb1ae84ff796cf98b8f2c8647f7252fc7ffd0e461197b7d6d944f75f1.exe binipeladokkkk.exe PID 1452 wrote to memory of 1096 1452 59f4e4afb1ae84ff796cf98b8f2c8647f7252fc7ffd0e461197b7d6d944f75f1.exe binipeladokkkk.exe PID 1452 wrote to memory of 1096 1452 59f4e4afb1ae84ff796cf98b8f2c8647f7252fc7ffd0e461197b7d6d944f75f1.exe binipeladokkkk.exe PID 1096 wrote to memory of 1116 1096 binipeladokkkk.exe binipeladokkkk.exe PID 1096 wrote to memory of 1116 1096 binipeladokkkk.exe binipeladokkkk.exe PID 1096 wrote to memory of 1116 1096 binipeladokkkk.exe binipeladokkkk.exe PID 1096 wrote to memory of 1116 1096 binipeladokkkk.exe binipeladokkkk.exe PID 1096 wrote to memory of 1116 1096 binipeladokkkk.exe binipeladokkkk.exe PID 1096 wrote to memory of 1116 1096 binipeladokkkk.exe binipeladokkkk.exe PID 1096 wrote to memory of 1116 1096 binipeladokkkk.exe binipeladokkkk.exe PID 1096 wrote to memory of 1116 1096 binipeladokkkk.exe binipeladokkkk.exe PID 1096 wrote to memory of 1116 1096 binipeladokkkk.exe binipeladokkkk.exe PID 1096 wrote to memory of 1116 1096 binipeladokkkk.exe binipeladokkkk.exe PID 1096 wrote to memory of 1116 1096 binipeladokkkk.exe binipeladokkkk.exe PID 1116 wrote to memory of 1060 1116 binipeladokkkk.exe mstwain32.exe PID 1116 wrote to memory of 1060 1116 binipeladokkkk.exe mstwain32.exe PID 1116 wrote to memory of 1060 1116 binipeladokkkk.exe mstwain32.exe PID 1116 wrote to memory of 1060 1116 binipeladokkkk.exe mstwain32.exe PID 1060 wrote to memory of 880 1060 mstwain32.exe mstwain32.exe PID 1060 wrote to memory of 880 1060 mstwain32.exe mstwain32.exe PID 1060 wrote to memory of 880 1060 mstwain32.exe mstwain32.exe PID 1060 wrote to memory of 880 1060 mstwain32.exe mstwain32.exe PID 1060 wrote to memory of 880 1060 mstwain32.exe mstwain32.exe PID 1060 wrote to memory of 880 1060 mstwain32.exe mstwain32.exe PID 1060 wrote to memory of 880 1060 mstwain32.exe mstwain32.exe PID 1060 wrote to memory of 880 1060 mstwain32.exe mstwain32.exe PID 1060 wrote to memory of 880 1060 mstwain32.exe mstwain32.exe PID 1060 wrote to memory of 880 1060 mstwain32.exe mstwain32.exe PID 1060 wrote to memory of 880 1060 mstwain32.exe mstwain32.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\59f4e4afb1ae84ff796cf98b8f2c8647f7252fc7ffd0e461197b7d6d944f75f1.exe"C:\Users\Admin\AppData\Local\Temp\59f4e4afb1ae84ff796cf98b8f2c8647f7252fc7ffd0e461197b7d6d944f75f1.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\binipeladokkkk.exe"C:\Users\Admin\AppData\Local\Temp\binipeladokkkk.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\binipeladokkkk.exe"C:\Users\Admin\AppData\Local\Temp\binipeladokkkk.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\binipeladokkkk.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"5⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:880
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:1572
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:968
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Claro_De_Luna.jpgFilesize
238KB
MD59af5c2e6e4269c010e4d8e94b8f59749
SHA12feb6b33b8ac54954d30c67aaf111fcec275ab17
SHA2560649126b6b80e09dfece3809fbbba314c2afa6b6d38d0a89f147149a5bea9540
SHA5121f8148b2d61ad673c7c8cc34219f8a433979bbd845aa2c0b8b4d52de92887badf06f971d73696e9ad7c428b377d8d423e849e056a5c625cea4d0cb28b3cc1166
-
C:\Users\Admin\AppData\Local\Temp\binipeladokkkk.exeFilesize
1.0MB
MD5fafb0b141634aae7506d50d1110efcfb
SHA17150d7be934e808e279c1da83e595e2d198338ce
SHA2565abae6db55d99a664277cb904ef9afef131c8de1601d5472e196f9f47b4c23cc
SHA512bcfe17ef4d0d34577e38cdeda4442ac1108fe1dbb1db7a896d221998e89cf33ca5c4b78f736f8da4be24058676e6dc3f3b6281612556093b369e59dc7e7ad15e
-
C:\Users\Admin\AppData\Local\Temp\binipeladokkkk.exeFilesize
1.0MB
MD5fafb0b141634aae7506d50d1110efcfb
SHA17150d7be934e808e279c1da83e595e2d198338ce
SHA2565abae6db55d99a664277cb904ef9afef131c8de1601d5472e196f9f47b4c23cc
SHA512bcfe17ef4d0d34577e38cdeda4442ac1108fe1dbb1db7a896d221998e89cf33ca5c4b78f736f8da4be24058676e6dc3f3b6281612556093b369e59dc7e7ad15e
-
C:\Users\Admin\AppData\Local\Temp\binipeladokkkk.exeFilesize
1.0MB
MD5fafb0b141634aae7506d50d1110efcfb
SHA17150d7be934e808e279c1da83e595e2d198338ce
SHA2565abae6db55d99a664277cb904ef9afef131c8de1601d5472e196f9f47b4c23cc
SHA512bcfe17ef4d0d34577e38cdeda4442ac1108fe1dbb1db7a896d221998e89cf33ca5c4b78f736f8da4be24058676e6dc3f3b6281612556093b369e59dc7e7ad15e
-
C:\Windows\mstwain32.exeFilesize
1.0MB
MD5fafb0b141634aae7506d50d1110efcfb
SHA17150d7be934e808e279c1da83e595e2d198338ce
SHA2565abae6db55d99a664277cb904ef9afef131c8de1601d5472e196f9f47b4c23cc
SHA512bcfe17ef4d0d34577e38cdeda4442ac1108fe1dbb1db7a896d221998e89cf33ca5c4b78f736f8da4be24058676e6dc3f3b6281612556093b369e59dc7e7ad15e
-
C:\Windows\mstwain32.exeFilesize
1.0MB
MD5fafb0b141634aae7506d50d1110efcfb
SHA17150d7be934e808e279c1da83e595e2d198338ce
SHA2565abae6db55d99a664277cb904ef9afef131c8de1601d5472e196f9f47b4c23cc
SHA512bcfe17ef4d0d34577e38cdeda4442ac1108fe1dbb1db7a896d221998e89cf33ca5c4b78f736f8da4be24058676e6dc3f3b6281612556093b369e59dc7e7ad15e
-
C:\Windows\mstwain32.exeFilesize
1.0MB
MD5fafb0b141634aae7506d50d1110efcfb
SHA17150d7be934e808e279c1da83e595e2d198338ce
SHA2565abae6db55d99a664277cb904ef9afef131c8de1601d5472e196f9f47b4c23cc
SHA512bcfe17ef4d0d34577e38cdeda4442ac1108fe1dbb1db7a896d221998e89cf33ca5c4b78f736f8da4be24058676e6dc3f3b6281612556093b369e59dc7e7ad15e
-
\Users\Admin\AppData\Local\Temp\binipeladokkkk.exeFilesize
1.0MB
MD5fafb0b141634aae7506d50d1110efcfb
SHA17150d7be934e808e279c1da83e595e2d198338ce
SHA2565abae6db55d99a664277cb904ef9afef131c8de1601d5472e196f9f47b4c23cc
SHA512bcfe17ef4d0d34577e38cdeda4442ac1108fe1dbb1db7a896d221998e89cf33ca5c4b78f736f8da4be24058676e6dc3f3b6281612556093b369e59dc7e7ad15e
-
\Users\Admin\AppData\Local\Temp\binipeladokkkk.exeFilesize
1.0MB
MD5fafb0b141634aae7506d50d1110efcfb
SHA17150d7be934e808e279c1da83e595e2d198338ce
SHA2565abae6db55d99a664277cb904ef9afef131c8de1601d5472e196f9f47b4c23cc
SHA512bcfe17ef4d0d34577e38cdeda4442ac1108fe1dbb1db7a896d221998e89cf33ca5c4b78f736f8da4be24058676e6dc3f3b6281612556093b369e59dc7e7ad15e
-
memory/880-110-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/880-108-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/880-107-0x0000000000AB0000-0x0000000000ABE000-memory.dmpFilesize
56KB
-
memory/880-106-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/880-102-0x0000000000430464-mapping.dmp
-
memory/1060-84-0x0000000000000000-mapping.dmp
-
memory/1096-59-0x0000000000000000-mapping.dmp
-
memory/1116-74-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1116-88-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1116-82-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1116-76-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1116-77-0x0000000000430464-mapping.dmp
-
memory/1116-64-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1116-79-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1116-81-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1116-65-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1116-72-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1116-71-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1116-69-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1116-67-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1452-56-0x0000000075041000-0x0000000075043000-memory.dmpFilesize
8KB