Analysis
-
max time kernel
141s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03/02/2024, 15:58
Static task
static1
Behavioral task
behavioral1
Sample
8cbdba902238db9a376fa17f3abd9746.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8cbdba902238db9a376fa17f3abd9746.exe
Resource
win10v2004-20231222-en
General
-
Target
8cbdba902238db9a376fa17f3abd9746.exe
-
Size
222KB
-
MD5
8cbdba902238db9a376fa17f3abd9746
-
SHA1
e5d9838a6646395558cb4f3f8dc036b90a678afd
-
SHA256
ae752871d3a8aed991f07ba17a880aab46fb9d254cc7db35cd9c1a90cb86b41f
-
SHA512
6dd9d92b09ffba92ea72713105c8e0822c006154b644668298c0872b22f6ced1725005e5e80ed3ba838f18400f1c0dfbb886e7f3235287cfecc3a1cdb3cd803a
-
SSDEEP
6144:A9t6MP2LfyMLPxg0yHALfxFQ5zWIDJ+bEs3:2MM+Dy4S0yHALJFmGbEs3
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 23 IoCs
resource yara_rule behavioral1/memory/3056-22-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/3056-23-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/3056-21-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/3056-27-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/3056-38-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2748-62-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2748-61-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2748-63-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2748-70-0x0000000074CA0000-0x0000000074D90000-memory.dmp modiloader_stage2 behavioral1/memory/2748-73-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2748-74-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2748-75-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2748-76-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2748-78-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2748-79-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2748-81-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2748-82-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2748-83-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2748-84-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2748-85-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2748-86-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2748-87-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/2748-88-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
pid Process 932 mstwain32.exe 2748 mstwain32.exe -
resource yara_rule behavioral1/memory/3056-11-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/3056-13-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/3056-17-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/3056-20-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/3056-22-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/3056-23-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/3056-21-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/3056-27-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/3056-38-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2748-59-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2748-62-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2748-61-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2748-63-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2748-73-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2748-74-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2748-75-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2748-76-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2748-78-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2748-79-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2748-81-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2748-82-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2748-83-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2748-84-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2748-85-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2748-86-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2748-87-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2748-88-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8cbdba902238db9a376fa17f3abd9746.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2448 set thread context of 3056 2448 8cbdba902238db9a376fa17f3abd9746.exe 28 PID 932 set thread context of 2748 932 mstwain32.exe 33 -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\mstwain32.exe-up.txt mstwain32.exe File opened for modification C:\Windows\mstwain32.exe mstwain32.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe File created C:\Windows\mstwain32.exe 8cbdba902238db9a376fa17f3abd9746.exe File opened for modification C:\Windows\mstwain32.exe 8cbdba902238db9a376fa17f3abd9746.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3056 8cbdba902238db9a376fa17f3abd9746.exe Token: SeBackupPrivilege 3052 vssvc.exe Token: SeRestorePrivilege 3052 vssvc.exe Token: SeAuditPrivilege 3052 vssvc.exe Token: SeDebugPrivilege 2748 mstwain32.exe Token: SeDebugPrivilege 2748 mstwain32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2448 8cbdba902238db9a376fa17f3abd9746.exe 932 mstwain32.exe 2748 mstwain32.exe 2748 mstwain32.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2448 wrote to memory of 3056 2448 8cbdba902238db9a376fa17f3abd9746.exe 28 PID 2448 wrote to memory of 3056 2448 8cbdba902238db9a376fa17f3abd9746.exe 28 PID 2448 wrote to memory of 3056 2448 8cbdba902238db9a376fa17f3abd9746.exe 28 PID 2448 wrote to memory of 3056 2448 8cbdba902238db9a376fa17f3abd9746.exe 28 PID 2448 wrote to memory of 3056 2448 8cbdba902238db9a376fa17f3abd9746.exe 28 PID 2448 wrote to memory of 3056 2448 8cbdba902238db9a376fa17f3abd9746.exe 28 PID 2448 wrote to memory of 3056 2448 8cbdba902238db9a376fa17f3abd9746.exe 28 PID 2448 wrote to memory of 3056 2448 8cbdba902238db9a376fa17f3abd9746.exe 28 PID 3056 wrote to memory of 932 3056 8cbdba902238db9a376fa17f3abd9746.exe 32 PID 3056 wrote to memory of 932 3056 8cbdba902238db9a376fa17f3abd9746.exe 32 PID 3056 wrote to memory of 932 3056 8cbdba902238db9a376fa17f3abd9746.exe 32 PID 3056 wrote to memory of 932 3056 8cbdba902238db9a376fa17f3abd9746.exe 32 PID 932 wrote to memory of 2748 932 mstwain32.exe 33 PID 932 wrote to memory of 2748 932 mstwain32.exe 33 PID 932 wrote to memory of 2748 932 mstwain32.exe 33 PID 932 wrote to memory of 2748 932 mstwain32.exe 33 PID 932 wrote to memory of 2748 932 mstwain32.exe 33 PID 932 wrote to memory of 2748 932 mstwain32.exe 33 PID 932 wrote to memory of 2748 932 mstwain32.exe 33 PID 932 wrote to memory of 2748 932 mstwain32.exe 33 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cbdba902238db9a376fa17f3abd9746.exe"C:\Users\Admin\AppData\Local\Temp\8cbdba902238db9a376fa17f3abd9746.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\8cbdba902238db9a376fa17f3abd9746.exeC:\Users\Admin\AppData\Local\Temp\8cbdba902238db9a376fa17f3abd9746.exe2⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\8cbdba902238db9a376fa17f3abd9746.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\mstwain32.exeC:\Windows\mstwain32.exe4⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2748
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3052
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
222KB
MD58cbdba902238db9a376fa17f3abd9746
SHA1e5d9838a6646395558cb4f3f8dc036b90a678afd
SHA256ae752871d3a8aed991f07ba17a880aab46fb9d254cc7db35cd9c1a90cb86b41f
SHA5126dd9d92b09ffba92ea72713105c8e0822c006154b644668298c0872b22f6ced1725005e5e80ed3ba838f18400f1c0dfbb886e7f3235287cfecc3a1cdb3cd803a