Analysis
-
max time kernel
191s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 20:30
Static task
static1
Behavioral task
behavioral1
Sample
ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe
Resource
win10v2004-20220812-en
General
-
Target
ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe
-
Size
252KB
-
MD5
bd1dfa7b9c24902277019104a80488fa
-
SHA1
8ad2983b4c28e82393004b05ff5e6fc4f47fe9bf
-
SHA256
ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af
-
SHA512
e9b0281dcd38ee5d7175739052b66a8d9f950c11337b018a17ebcbdd593122999dcd8dcf0169e2f32187617bf2c3759a93cf83c6e8edd641639da3e49b170e56
-
SSDEEP
6144:3+sgruWCTXu0+EI8AroFQDDP/m5dNP8ICzdBoQS6:rMuWCiNf8uDDodl8IedBoQn
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Processes:
mstwain32.exeec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exemstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Processes:
ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exemstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" mstwain32.exe -
ModiLoader Second Stage 11 IoCs
Processes:
resource yara_rule behavioral2/memory/2816-134-0x0000000000000000-mapping.dmp modiloader_stage2 behavioral2/memory/2816-135-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/2816-136-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/2816-137-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/2816-138-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/2816-142-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/740-145-0x0000000000000000-mapping.dmp modiloader_stage2 behavioral2/memory/740-149-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/740-150-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/740-153-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 behavioral2/memory/740-157-0x0000000000400000-0x000000000044B000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
Processes:
mstwain32.exemstwain32.exepid process 3400 mstwain32.exe 740 mstwain32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe -
Loads dropped DLL 4 IoCs
Processes:
mstwain32.exepid process 740 mstwain32.exe 740 mstwain32.exe 740 mstwain32.exe 740 mstwain32.exe -
Processes:
mstwain32.exeec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
mstwain32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ mstwain32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
Processes:
mstwain32.exemstwain32.exeec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exeec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exemstwain32.exedescription pid process target process PID 4880 set thread context of 2816 4880 ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe PID 3400 set thread context of 740 3400 mstwain32.exe mstwain32.exe -
Drops file in Windows directory 4 IoCs
Processes:
ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exemstwain32.exedescription ioc process File opened for modification C:\Windows\mstwain32.exe ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe File created C:\Windows\mstwain32.exe ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exevssvc.exemstwain32.exedescription pid process Token: SeDebugPrivilege 2816 ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe Token: SeBackupPrivilege 2168 vssvc.exe Token: SeRestorePrivilege 2168 vssvc.exe Token: SeAuditPrivilege 2168 vssvc.exe Token: SeDebugPrivilege 740 mstwain32.exe Token: SeDebugPrivilege 740 mstwain32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exemstwain32.exemstwain32.exepid process 4880 ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe 3400 mstwain32.exe 740 mstwain32.exe 740 mstwain32.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exeec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exemstwain32.exedescription pid process target process PID 4880 wrote to memory of 2816 4880 ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe PID 4880 wrote to memory of 2816 4880 ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe PID 4880 wrote to memory of 2816 4880 ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe PID 4880 wrote to memory of 2816 4880 ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe PID 4880 wrote to memory of 2816 4880 ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe PID 4880 wrote to memory of 2816 4880 ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe PID 4880 wrote to memory of 2816 4880 ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe PID 4880 wrote to memory of 2816 4880 ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe PID 4880 wrote to memory of 2816 4880 ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe PID 4880 wrote to memory of 2816 4880 ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe PID 4880 wrote to memory of 2816 4880 ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe PID 4880 wrote to memory of 2816 4880 ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe PID 4880 wrote to memory of 2816 4880 ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe PID 2816 wrote to memory of 3400 2816 ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe mstwain32.exe PID 2816 wrote to memory of 3400 2816 ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe mstwain32.exe PID 2816 wrote to memory of 3400 2816 ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe mstwain32.exe PID 3400 wrote to memory of 740 3400 mstwain32.exe mstwain32.exe PID 3400 wrote to memory of 740 3400 mstwain32.exe mstwain32.exe PID 3400 wrote to memory of 740 3400 mstwain32.exe mstwain32.exe PID 3400 wrote to memory of 740 3400 mstwain32.exe mstwain32.exe PID 3400 wrote to memory of 740 3400 mstwain32.exe mstwain32.exe PID 3400 wrote to memory of 740 3400 mstwain32.exe mstwain32.exe PID 3400 wrote to memory of 740 3400 mstwain32.exe mstwain32.exe PID 3400 wrote to memory of 740 3400 mstwain32.exe mstwain32.exe PID 3400 wrote to memory of 740 3400 mstwain32.exe mstwain32.exe PID 3400 wrote to memory of 740 3400 mstwain32.exe mstwain32.exe PID 3400 wrote to memory of 740 3400 mstwain32.exe mstwain32.exe PID 3400 wrote to memory of 740 3400 mstwain32.exe mstwain32.exe PID 3400 wrote to memory of 740 3400 mstwain32.exe mstwain32.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
mstwain32.exeec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exemstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe"C:\Users\Admin\AppData\Local\Temp\ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe"1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exeC:\Users\Admin\AppData\Local\Temp\ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe2⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af.exe"3⤵
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\mstwain32.exeC:\Windows\mstwain32.exe4⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\cmsetac.dllFilesize
33KB
MD57c3ff4d4d394fde7c693d04c488a55f8
SHA1ae2b2acc7e91a910f9075e0e095b528e97827ba4
SHA2564878bf71fd37ffac1fd6f5153357298544d0ef1f3a114c1f0451befcb85c59a8
SHA51233c601d9e706cff0c3dce8280b040c361aa51004fd20b51946469b6a02453def5a7aad1e5f58bec3435cc6e25470155d07f71dc0f81ec642efc53215d7be316a
-
C:\Windows\cmsetac.dllFilesize
33KB
MD57c3ff4d4d394fde7c693d04c488a55f8
SHA1ae2b2acc7e91a910f9075e0e095b528e97827ba4
SHA2564878bf71fd37ffac1fd6f5153357298544d0ef1f3a114c1f0451befcb85c59a8
SHA51233c601d9e706cff0c3dce8280b040c361aa51004fd20b51946469b6a02453def5a7aad1e5f58bec3435cc6e25470155d07f71dc0f81ec642efc53215d7be316a
-
C:\Windows\mstwain32.exeFilesize
252KB
MD5bd1dfa7b9c24902277019104a80488fa
SHA18ad2983b4c28e82393004b05ff5e6fc4f47fe9bf
SHA256ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af
SHA512e9b0281dcd38ee5d7175739052b66a8d9f950c11337b018a17ebcbdd593122999dcd8dcf0169e2f32187617bf2c3759a93cf83c6e8edd641639da3e49b170e56
-
C:\Windows\mstwain32.exeFilesize
252KB
MD5bd1dfa7b9c24902277019104a80488fa
SHA18ad2983b4c28e82393004b05ff5e6fc4f47fe9bf
SHA256ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af
SHA512e9b0281dcd38ee5d7175739052b66a8d9f950c11337b018a17ebcbdd593122999dcd8dcf0169e2f32187617bf2c3759a93cf83c6e8edd641639da3e49b170e56
-
C:\Windows\mstwain32.exeFilesize
252KB
MD5bd1dfa7b9c24902277019104a80488fa
SHA18ad2983b4c28e82393004b05ff5e6fc4f47fe9bf
SHA256ec62f21d53859c3d31db7d7f49ccef494793f9dbb6e060f9d42d86403c2853af
SHA512e9b0281dcd38ee5d7175739052b66a8d9f950c11337b018a17ebcbdd593122999dcd8dcf0169e2f32187617bf2c3759a93cf83c6e8edd641639da3e49b170e56
-
C:\Windows\ntdtcstp.dllFilesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
C:\Windows\ntdtcstp.dllFilesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
-
memory/740-153-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/740-145-0x0000000000000000-mapping.dmp
-
memory/740-149-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/740-150-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/740-156-0x0000000002B00000-0x0000000002B0E000-memory.dmpFilesize
56KB
-
memory/740-157-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/2816-142-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/2816-138-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/2816-137-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/2816-134-0x0000000000000000-mapping.dmp
-
memory/2816-136-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/2816-135-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/3400-139-0x0000000000000000-mapping.dmp