Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12-01-2024 15:47

General

  • Target

    56dde7f80911ca81a8f9dd4871fc9539.exe

  • Size

    2.1MB

  • MD5

    56dde7f80911ca81a8f9dd4871fc9539

  • SHA1

    a9cdc4891a64e67f54609021a4fad9f41764d3f8

  • SHA256

    a5befd9e316873b0121473bb8456ba3979331f1337636d781d2d4e15efadc9e3

  • SHA512

    980eca2f59755478825325d40011476d1815ebe261be5337592c0f9aa384a3f1a1161b7f0b7ac8818c77455a1b1bf5195fd459af41373cd0e3bf9d47821b7fbf

  • SSDEEP

    49152:cjR01i7zWYNcQRKg62Jjrn7VxWWhzSenZncQLVxft5DEuq:cjv+KTKg5jj7thzSenZBZxnD4

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • UAC bypass 3 TTPs 1 IoCs
  • ModiLoader Second Stage 28 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • System policy modification 1 TTPs 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\56dde7f80911ca81a8f9dd4871fc9539.exe
    "C:\Users\Admin\AppData\Local\Temp\56dde7f80911ca81a8f9dd4871fc9539.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Users\Admin\AppData\Local\Temp\56dde7f80911ca81a8f9dd4871fc9539.exe
      C:\Users\Admin\AppData\Local\Temp\56dde7f80911ca81a8f9dd4871fc9539.exe
      2⤵
      • Checks whether UAC is enabled
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2652
      • C:\Windows\mstwain32.exe
        "C:\Windows\mstwain32.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1972
        • C:\Windows\mstwain32.exe
          C:\Windows\mstwain32.exe
          4⤵
          • UAC bypass
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • System policy modification
          PID:2184
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2300

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\mstwain32.exe

    Filesize

    2.1MB

    MD5

    56dde7f80911ca81a8f9dd4871fc9539

    SHA1

    a9cdc4891a64e67f54609021a4fad9f41764d3f8

    SHA256

    a5befd9e316873b0121473bb8456ba3979331f1337636d781d2d4e15efadc9e3

    SHA512

    980eca2f59755478825325d40011476d1815ebe261be5337592c0f9aa384a3f1a1161b7f0b7ac8818c77455a1b1bf5195fd459af41373cd0e3bf9d47821b7fbf

  • memory/1976-0-0x0000000000400000-0x0000000000617000-memory.dmp

    Filesize

    2.1MB

  • memory/2184-68-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2184-74-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2184-79-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2184-62-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2184-78-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2184-77-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2184-76-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2184-63-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2184-75-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2184-65-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2184-73-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2184-72-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2184-71-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2184-64-0x00000000003C0000-0x00000000003C1000-memory.dmp

    Filesize

    4KB

  • memory/2184-58-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2184-59-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2184-69-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2184-67-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2184-66-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2652-21-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2652-34-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2652-20-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2652-3-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2652-9-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2652-5-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2652-23-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2652-22-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2652-7-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2652-19-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2652-13-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2652-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2652-15-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/2652-11-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB