Analysis
-
max time kernel
262s -
max time network
333s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 00:13
Behavioral task
behavioral1
Sample
c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exe
Resource
win7-20221111-en
General
-
Target
c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exe
-
Size
804KB
-
MD5
0b2a0a1dddacb93c50311469b3583b70
-
SHA1
22f0dd1b0d00b1de36697bc9986b8905f8a222f6
-
SHA256
c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b
-
SHA512
4fda46be71993467fcdd3cc71df54c72769f250f0ba479dfa6019d83f67e7f859b8da4a34eaa71cd4663539cdf17733be94df988924da2d8bc1a714f2ac8e8d0
-
SSDEEP
24576:y2O+HDP76i8WNlyUjawUYyyr7RrU7WKZb:i+HDPelWVjnyuJzMb
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1488-56-0x0000000000400000-0x00000000005BF000-memory.dmp modiloader_stage2 behavioral1/memory/1488-62-0x0000000000400000-0x00000000005BF000-memory.dmp modiloader_stage2 behavioral1/memory/1752-64-0x0000000000400000-0x00000000005BF000-memory.dmp modiloader_stage2 behavioral1/memory/1752-66-0x0000000000400000-0x00000000005BF000-memory.dmp modiloader_stage2 behavioral1/memory/1752-67-0x0000000000400000-0x00000000005BF000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
mstwain32.exepid process 1752 mstwain32.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exemstwain32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Wine c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exe Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Wine mstwain32.exe -
Processes:
resource yara_rule behavioral1/memory/1488-54-0x0000000000400000-0x00000000005BF000-memory.dmp themida behavioral1/memory/1488-56-0x0000000000400000-0x00000000005BF000-memory.dmp themida C:\Windows\mstwain32.exe themida behavioral1/memory/1752-61-0x0000000000400000-0x00000000005BF000-memory.dmp themida behavioral1/memory/1488-62-0x0000000000400000-0x00000000005BF000-memory.dmp themida behavioral1/memory/1752-64-0x0000000000400000-0x00000000005BF000-memory.dmp themida behavioral1/memory/1752-66-0x0000000000400000-0x00000000005BF000-memory.dmp themida behavioral1/memory/1752-67-0x0000000000400000-0x00000000005BF000-memory.dmp themida -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
mstwain32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ mstwain32.exe -
Processes:
c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exemstwain32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exemstwain32.exepid process 1488 c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exe 1752 mstwain32.exe -
Drops file in Windows directory 4 IoCs
Processes:
mstwain32.exec63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exedescription ioc process File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe File created C:\Windows\mstwain32.exe c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exe File opened for modification C:\Windows\mstwain32.exe c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exemstwain32.exepid process 1488 c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exe 1752 mstwain32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exemstwain32.exedescription pid process Token: SeDebugPrivilege 1488 c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exe Token: SeDebugPrivilege 1752 mstwain32.exe Token: SeDebugPrivilege 1752 mstwain32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mstwain32.exepid process 1752 mstwain32.exe 1752 mstwain32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exedescription pid process target process PID 1488 wrote to memory of 1752 1488 c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exe mstwain32.exe PID 1488 wrote to memory of 1752 1488 c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exe mstwain32.exe PID 1488 wrote to memory of 1752 1488 c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exe mstwain32.exe PID 1488 wrote to memory of 1752 1488 c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exe mstwain32.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exe"C:\Users\Admin\AppData\Local\Temp\c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b.exe"1⤵
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\mstwain32.exeFilesize
804KB
MD50b2a0a1dddacb93c50311469b3583b70
SHA122f0dd1b0d00b1de36697bc9986b8905f8a222f6
SHA256c63a3e8be50430ca423f9b8ae8c072e96d61703e8bda2fcebf6adf7e0893b08b
SHA5124fda46be71993467fcdd3cc71df54c72769f250f0ba479dfa6019d83f67e7f859b8da4a34eaa71cd4663539cdf17733be94df988924da2d8bc1a714f2ac8e8d0
-
memory/1488-60-0x0000000005310000-0x00000000054CF000-memory.dmpFilesize
1.7MB
-
memory/1488-56-0x0000000000400000-0x00000000005BF000-memory.dmpFilesize
1.7MB
-
memory/1488-57-0x00000000046A0000-0x00000000046B0000-memory.dmpFilesize
64KB
-
memory/1488-55-0x0000000076771000-0x0000000076773000-memory.dmpFilesize
8KB
-
memory/1488-54-0x0000000000400000-0x00000000005BF000-memory.dmpFilesize
1.7MB
-
memory/1488-62-0x0000000000400000-0x00000000005BF000-memory.dmpFilesize
1.7MB
-
memory/1752-58-0x0000000000000000-mapping.dmp
-
memory/1752-61-0x0000000000400000-0x00000000005BF000-memory.dmpFilesize
1.7MB
-
memory/1752-64-0x0000000000400000-0x00000000005BF000-memory.dmpFilesize
1.7MB
-
memory/1752-65-0x0000000004760000-0x000000000476E000-memory.dmpFilesize
56KB
-
memory/1752-66-0x0000000000400000-0x00000000005BF000-memory.dmpFilesize
1.7MB
-
memory/1752-67-0x0000000000400000-0x00000000005BF000-memory.dmpFilesize
1.7MB