Analysis
-
max time kernel
149s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 17:40
Behavioral task
behavioral1
Sample
cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe
Resource
win10v2004-20220812-en
General
-
Target
cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe
-
Size
442KB
-
MD5
2f8cd4ba2b9844213d8cd69bdbb0485b
-
SHA1
13640f1735c6d97906985ee7dad0f5bf9ac9e394
-
SHA256
cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae
-
SHA512
2ce09a5cbe10ad0f62bb300ffde12c6b4f3f96cef49a2e0a85f6570fa73017256a4c5e8f085649129b3d30f740bcb24bb7aae947829d5b38f95eb4aeff287593
-
SSDEEP
6144:TBgh/58KGip9lmh0UwwDdxtPw13OyhFR8uHQaEFmgYs2R3hSP1p7a1ZLcPR2GTJz:TBMmKGnhDT+JlCraEFmgqdwYA2GFz
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 5 IoCs
Processes:
resource yara_rule behavioral1/memory/848-66-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/848-69-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1452-84-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1452-86-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1452-87-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
mstwain32.exemstwain32.exepid process 1944 mstwain32.exe 1452 mstwain32.exe -
Processes:
resource yara_rule behavioral1/memory/1652-55-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/memory/848-57-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/848-59-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/848-60-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1652-63-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/memory/848-65-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/848-66-0x0000000000400000-0x0000000000450000-memory.dmp upx C:\Windows\mstwain32.exe upx behavioral1/memory/848-69-0x0000000000400000-0x0000000000450000-memory.dmp upx C:\Windows\mstwain32.exe upx behavioral1/memory/1944-72-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/memory/1944-80-0x0000000000400000-0x00000000004CF000-memory.dmp upx C:\Windows\mstwain32.exe upx behavioral1/memory/1452-83-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1452-84-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1452-86-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1452-87-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
mstwain32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ mstwain32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
Processes:
cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exemstwain32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1652-63-0x0000000000400000-0x00000000004CF000-memory.dmp autoit_exe behavioral1/memory/1944-72-0x0000000000400000-0x00000000004CF000-memory.dmp autoit_exe behavioral1/memory/1944-80-0x0000000000400000-0x00000000004CF000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exemstwain32.exedescription pid process target process PID 1652 set thread context of 848 1652 cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe PID 1944 set thread context of 1452 1944 mstwain32.exe mstwain32.exe -
Drops file in Windows directory 4 IoCs
Processes:
mstwain32.execde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exedescription ioc process File created C:\Windows\cmsetac.dll mstwain32.exe File created C:\Windows\mstwain32.exe cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe File opened for modification C:\Windows\mstwain32.exe cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exemstwain32.exedescription pid process Token: SeDebugPrivilege 848 cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe Token: SeDebugPrivilege 1452 mstwain32.exe Token: SeDebugPrivilege 1452 mstwain32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mstwain32.exepid process 1452 mstwain32.exe 1452 mstwain32.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.execde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exemstwain32.exedescription pid process target process PID 1652 wrote to memory of 848 1652 cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe PID 1652 wrote to memory of 848 1652 cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe PID 1652 wrote to memory of 848 1652 cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe PID 1652 wrote to memory of 848 1652 cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe PID 1652 wrote to memory of 848 1652 cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe PID 1652 wrote to memory of 848 1652 cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe PID 1652 wrote to memory of 848 1652 cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe PID 848 wrote to memory of 1944 848 cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe mstwain32.exe PID 848 wrote to memory of 1944 848 cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe mstwain32.exe PID 848 wrote to memory of 1944 848 cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe mstwain32.exe PID 848 wrote to memory of 1944 848 cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe mstwain32.exe PID 1944 wrote to memory of 1452 1944 mstwain32.exe mstwain32.exe PID 1944 wrote to memory of 1452 1944 mstwain32.exe mstwain32.exe PID 1944 wrote to memory of 1452 1944 mstwain32.exe mstwain32.exe PID 1944 wrote to memory of 1452 1944 mstwain32.exe mstwain32.exe PID 1944 wrote to memory of 1452 1944 mstwain32.exe mstwain32.exe PID 1944 wrote to memory of 1452 1944 mstwain32.exe mstwain32.exe PID 1944 wrote to memory of 1452 1944 mstwain32.exe mstwain32.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe"C:\Users\Admin\AppData\Local\Temp\cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe"C:\Users\Admin\AppData\Local\Temp\cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae.exe"2⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"4⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1452
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\mstwain32.exeFilesize
442KB
MD52f8cd4ba2b9844213d8cd69bdbb0485b
SHA113640f1735c6d97906985ee7dad0f5bf9ac9e394
SHA256cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae
SHA5122ce09a5cbe10ad0f62bb300ffde12c6b4f3f96cef49a2e0a85f6570fa73017256a4c5e8f085649129b3d30f740bcb24bb7aae947829d5b38f95eb4aeff287593
-
C:\Windows\mstwain32.exeFilesize
442KB
MD52f8cd4ba2b9844213d8cd69bdbb0485b
SHA113640f1735c6d97906985ee7dad0f5bf9ac9e394
SHA256cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae
SHA5122ce09a5cbe10ad0f62bb300ffde12c6b4f3f96cef49a2e0a85f6570fa73017256a4c5e8f085649129b3d30f740bcb24bb7aae947829d5b38f95eb4aeff287593
-
C:\Windows\mstwain32.exeFilesize
442KB
MD52f8cd4ba2b9844213d8cd69bdbb0485b
SHA113640f1735c6d97906985ee7dad0f5bf9ac9e394
SHA256cde659e7cf67676e78c075393ec2562e73b6739da9df9187b195b2a58158a5ae
SHA5122ce09a5cbe10ad0f62bb300ffde12c6b4f3f96cef49a2e0a85f6570fa73017256a4c5e8f085649129b3d30f740bcb24bb7aae947829d5b38f95eb4aeff287593
-
memory/848-56-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/848-57-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/848-59-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/848-60-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/848-61-0x000000000044D950-mapping.dmp
-
memory/848-65-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/848-66-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/848-69-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1452-78-0x000000000044D950-mapping.dmp
-
memory/1452-83-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1452-84-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1452-85-0x0000000002250000-0x000000000225E000-memory.dmpFilesize
56KB
-
memory/1452-86-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1452-87-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1652-63-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/1652-54-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB
-
memory/1652-55-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/1944-67-0x0000000000000000-mapping.dmp
-
memory/1944-72-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/1944-80-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB