Analysis

  • max time kernel
    144s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29/01/2024, 00:11 UTC

General

  • Target

    7e5ed0f125ebcfccc4c256c1b753e367.exe

  • Size

    999KB

  • MD5

    7e5ed0f125ebcfccc4c256c1b753e367

  • SHA1

    c4ab02cfae62e0ab4932233f7397f41057bf362c

  • SHA256

    ea6b7a5a586cff0836c14018509e93ddcf75b524694c2a6bda166efd1d86f9c9

  • SHA512

    d2f2a31df5a11a6c52038d06dfbd2b57656e8fe51cd505bbf8abc204b6f733a4e085ff1267b5e7a48e46b73c4f03e712fbb603dea54a3fd6532988164d11ca82

  • SSDEEP

    24576:ThAyNr5Xk6cJvH3scLUwo6ZEjmW0cfU43dzux:WyNr+6cdpo1mwc43Bu

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • UAC bypass 3 TTPs 1 IoCs
  • ModiLoader Second Stage 21 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Themida packer 23 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • System policy modification 1 TTPs 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e5ed0f125ebcfccc4c256c1b753e367.exe
    "C:\Users\Admin\AppData\Local\Temp\7e5ed0f125ebcfccc4c256c1b753e367.exe"
    1⤵
    • Identifies Wine through registry keys
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\Windows\mstwain32.exe
      "C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\7e5ed0f125ebcfccc4c256c1b753e367.exe"
      2⤵
      • UAC bypass
      • Deletes itself
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:1620
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2608

Network

  • flag-us
    DNS
    curisco04.no-ip.org
    mstwain32.exe
    Remote address:
    8.8.8.8:53
    Request
    curisco04.no-ip.org
    IN A
    Response
No results found
  • 8.8.8.8:53
    curisco04.no-ip.org
    dns
    mstwain32.exe
    65 B
    125 B
    1
    1

    DNS Request

    curisco04.no-ip.org

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\mstwain32.exe

    Filesize

    999KB

    MD5

    7e5ed0f125ebcfccc4c256c1b753e367

    SHA1

    c4ab02cfae62e0ab4932233f7397f41057bf362c

    SHA256

    ea6b7a5a586cff0836c14018509e93ddcf75b524694c2a6bda166efd1d86f9c9

    SHA512

    d2f2a31df5a11a6c52038d06dfbd2b57656e8fe51cd505bbf8abc204b6f733a4e085ff1267b5e7a48e46b73c4f03e712fbb603dea54a3fd6532988164d11ca82

  • memory/1620-51-0x0000000004190000-0x0000000004191000-memory.dmp

    Filesize

    4KB

  • memory/1620-52-0x0000000004140000-0x0000000004141000-memory.dmp

    Filesize

    4KB

  • memory/1620-88-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/1620-87-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/1620-86-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/1620-85-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/1620-84-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/1620-83-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/1620-82-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/1620-81-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/1620-80-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/1620-78-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/1620-55-0x0000000004090000-0x0000000004091000-memory.dmp

    Filesize

    4KB

  • memory/1620-77-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/1620-76-0x00000000766D0000-0x00000000767C0000-memory.dmp

    Filesize

    960KB

  • memory/1620-75-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/1620-74-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/1620-73-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/1620-72-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/1620-46-0x00000000041A0000-0x00000000041A1000-memory.dmp

    Filesize

    4KB

  • memory/1620-47-0x00000000040D0000-0x00000000040D1000-memory.dmp

    Filesize

    4KB

  • memory/1620-49-0x00000000040E0000-0x00000000040E1000-memory.dmp

    Filesize

    4KB

  • memory/1620-53-0x0000000004100000-0x0000000004101000-memory.dmp

    Filesize

    4KB

  • memory/1620-54-0x0000000004110000-0x0000000004112000-memory.dmp

    Filesize

    8KB

  • memory/1620-63-0x0000000004180000-0x0000000004181000-memory.dmp

    Filesize

    4KB

  • memory/1620-57-0x0000000004120000-0x0000000004121000-memory.dmp

    Filesize

    4KB

  • memory/1620-58-0x0000000004050000-0x0000000004051000-memory.dmp

    Filesize

    4KB

  • memory/1620-35-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/1620-59-0x0000000004150000-0x0000000004151000-memory.dmp

    Filesize

    4KB

  • memory/1620-44-0x00000000040B0000-0x00000000040B1000-memory.dmp

    Filesize

    4KB

  • memory/1620-42-0x0000000004060000-0x0000000004061000-memory.dmp

    Filesize

    4KB

  • memory/1620-43-0x0000000003ED0000-0x0000000003ED1000-memory.dmp

    Filesize

    4KB

  • memory/1620-40-0x0000000004040000-0x0000000004041000-memory.dmp

    Filesize

    4KB

  • memory/1620-39-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/1620-48-0x00000000044D0000-0x00000000044DE000-memory.dmp

    Filesize

    56KB

  • memory/1620-45-0x0000000004200000-0x0000000004201000-memory.dmp

    Filesize

    4KB

  • memory/1620-60-0x0000000004070000-0x0000000004071000-memory.dmp

    Filesize

    4KB

  • memory/1620-61-0x0000000004080000-0x0000000004081000-memory.dmp

    Filesize

    4KB

  • memory/1620-56-0x00000000040A0000-0x00000000040A1000-memory.dmp

    Filesize

    4KB

  • memory/1620-70-0x00000000041F0000-0x00000000041F1000-memory.dmp

    Filesize

    4KB

  • memory/1620-69-0x0000000004160000-0x0000000004161000-memory.dmp

    Filesize

    4KB

  • memory/1620-71-0x00000000044C0000-0x00000000044C1000-memory.dmp

    Filesize

    4KB

  • memory/1620-68-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/1620-67-0x00000000040F0000-0x00000000040F1000-memory.dmp

    Filesize

    4KB

  • memory/1620-66-0x0000000075580000-0x0000000075594000-memory.dmp

    Filesize

    80KB

  • memory/1620-65-0x00000000766D0000-0x00000000767C0000-memory.dmp

    Filesize

    960KB

  • memory/1620-62-0x00000000041C0000-0x00000000041C1000-memory.dmp

    Filesize

    4KB

  • memory/1620-64-0x00000000041E0000-0x00000000041E1000-memory.dmp

    Filesize

    4KB

  • memory/2192-5-0x00000000040C0000-0x00000000040C1000-memory.dmp

    Filesize

    4KB

  • memory/2192-11-0x0000000004110000-0x0000000004111000-memory.dmp

    Filesize

    4KB

  • memory/2192-1-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/2192-32-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/2192-2-0x0000000004050000-0x0000000004051000-memory.dmp

    Filesize

    4KB

  • memory/2192-26-0x0000000004170000-0x0000000004171000-memory.dmp

    Filesize

    4KB

  • memory/2192-27-0x00000000055C0000-0x00000000055D0000-memory.dmp

    Filesize

    64KB

  • memory/2192-16-0x0000000004180000-0x0000000004181000-memory.dmp

    Filesize

    4KB

  • memory/2192-0-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/2192-22-0x0000000000400000-0x00000000004FC000-memory.dmp

    Filesize

    1008KB

  • memory/2192-21-0x00000000005B0000-0x00000000005B1000-memory.dmp

    Filesize

    4KB

  • memory/2192-20-0x00000000041E0000-0x00000000041E1000-memory.dmp

    Filesize

    4KB

  • memory/2192-36-0x00000000055C0000-0x00000000055CD000-memory.dmp

    Filesize

    52KB

  • memory/2192-19-0x0000000004100000-0x0000000004101000-memory.dmp

    Filesize

    4KB

  • memory/2192-33-0x0000000004150000-0x0000000004151000-memory.dmp

    Filesize

    4KB

  • memory/2192-18-0x0000000004080000-0x0000000004081000-memory.dmp

    Filesize

    4KB

  • memory/2192-3-0x0000000004070000-0x0000000004071000-memory.dmp

    Filesize

    4KB

  • memory/2192-4-0x0000000004010000-0x0000000004011000-memory.dmp

    Filesize

    4KB

  • memory/2192-17-0x0000000004130000-0x0000000004131000-memory.dmp

    Filesize

    4KB

  • memory/2192-7-0x00000000040E0000-0x00000000040E1000-memory.dmp

    Filesize

    4KB

  • memory/2192-8-0x00000000040F0000-0x00000000040F1000-memory.dmp

    Filesize

    4KB

  • memory/2192-9-0x00000000041B0000-0x00000000041B1000-memory.dmp

    Filesize

    4KB

  • memory/2192-10-0x0000000004160000-0x0000000004161000-memory.dmp

    Filesize

    4KB

  • memory/2192-6-0x00000000041C0000-0x00000000041C1000-memory.dmp

    Filesize

    4KB

  • memory/2192-12-0x00000000040A0000-0x00000000040A1000-memory.dmp

    Filesize

    4KB

  • memory/2192-13-0x00000000040B0000-0x00000000040B1000-memory.dmp

    Filesize

    4KB

  • memory/2192-14-0x0000000004060000-0x0000000004061000-memory.dmp

    Filesize

    4KB

  • memory/2192-15-0x00000000041D0000-0x00000000041D1000-memory.dmp

    Filesize

    4KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.