Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2024, 15:58
Static task
static1
Behavioral task
behavioral1
Sample
8cbdba902238db9a376fa17f3abd9746.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8cbdba902238db9a376fa17f3abd9746.exe
Resource
win10v2004-20231222-en
General
-
Target
8cbdba902238db9a376fa17f3abd9746.exe
-
Size
222KB
-
MD5
8cbdba902238db9a376fa17f3abd9746
-
SHA1
e5d9838a6646395558cb4f3f8dc036b90a678afd
-
SHA256
ae752871d3a8aed991f07ba17a880aab46fb9d254cc7db35cd9c1a90cb86b41f
-
SHA512
6dd9d92b09ffba92ea72713105c8e0822c006154b644668298c0872b22f6ced1725005e5e80ed3ba838f18400f1c0dfbb886e7f3235287cfecc3a1cdb3cd803a
-
SSDEEP
6144:A9t6MP2LfyMLPxg0yHALfxFQ5zWIDJ+bEs3:2MM+Dy4S0yHALJFmGbEs3
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 22 IoCs
resource yara_rule behavioral2/memory/1456-12-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/1456-13-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/1456-24-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3932-39-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3932-40-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3932-41-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3932-55-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3932-58-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3932-59-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3932-60-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3932-63-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3932-66-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3932-69-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3932-72-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3932-75-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3932-78-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3932-81-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3932-84-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3932-87-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3932-90-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3932-93-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/3932-96-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 8cbdba902238db9a376fa17f3abd9746.exe -
Executes dropped EXE 2 IoCs
pid Process 1704 mstwain32.exe 3932 mstwain32.exe -
Loads dropped DLL 4 IoCs
pid Process 3932 mstwain32.exe 3932 mstwain32.exe 3932 mstwain32.exe 3932 mstwain32.exe -
resource yara_rule behavioral2/memory/1456-8-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/1456-11-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/1456-12-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/1456-13-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/1456-24-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-38-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-39-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-40-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-41-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-55-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-58-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-59-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-60-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-63-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-66-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-69-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-72-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-75-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-78-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-81-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-84-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-87-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-90-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-93-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3932-96-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8cbdba902238db9a376fa17f3abd9746.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1028 set thread context of 1456 1028 8cbdba902238db9a376fa17f3abd9746.exe 90 PID 1704 set thread context of 3932 1704 mstwain32.exe 98 -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe File created C:\Windows\mstwain32.exe 8cbdba902238db9a376fa17f3abd9746.exe File opened for modification C:\Windows\mstwain32.exe 8cbdba902238db9a376fa17f3abd9746.exe File created C:\Windows\mstwain32.exe-up.txt mstwain32.exe File opened for modification C:\Windows\mstwain32.exe mstwain32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1456 8cbdba902238db9a376fa17f3abd9746.exe Token: SeBackupPrivilege 3076 vssvc.exe Token: SeRestorePrivilege 3076 vssvc.exe Token: SeAuditPrivilege 3076 vssvc.exe Token: SeDebugPrivilege 3932 mstwain32.exe Token: SeDebugPrivilege 3932 mstwain32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1028 8cbdba902238db9a376fa17f3abd9746.exe 1704 mstwain32.exe 3932 mstwain32.exe 3932 mstwain32.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1028 wrote to memory of 1456 1028 8cbdba902238db9a376fa17f3abd9746.exe 90 PID 1028 wrote to memory of 1456 1028 8cbdba902238db9a376fa17f3abd9746.exe 90 PID 1028 wrote to memory of 1456 1028 8cbdba902238db9a376fa17f3abd9746.exe 90 PID 1028 wrote to memory of 1456 1028 8cbdba902238db9a376fa17f3abd9746.exe 90 PID 1028 wrote to memory of 1456 1028 8cbdba902238db9a376fa17f3abd9746.exe 90 PID 1028 wrote to memory of 1456 1028 8cbdba902238db9a376fa17f3abd9746.exe 90 PID 1028 wrote to memory of 1456 1028 8cbdba902238db9a376fa17f3abd9746.exe 90 PID 1028 wrote to memory of 1456 1028 8cbdba902238db9a376fa17f3abd9746.exe 90 PID 1456 wrote to memory of 1704 1456 8cbdba902238db9a376fa17f3abd9746.exe 96 PID 1456 wrote to memory of 1704 1456 8cbdba902238db9a376fa17f3abd9746.exe 96 PID 1456 wrote to memory of 1704 1456 8cbdba902238db9a376fa17f3abd9746.exe 96 PID 1704 wrote to memory of 3932 1704 mstwain32.exe 98 PID 1704 wrote to memory of 3932 1704 mstwain32.exe 98 PID 1704 wrote to memory of 3932 1704 mstwain32.exe 98 PID 1704 wrote to memory of 3932 1704 mstwain32.exe 98 PID 1704 wrote to memory of 3932 1704 mstwain32.exe 98 PID 1704 wrote to memory of 3932 1704 mstwain32.exe 98 PID 1704 wrote to memory of 3932 1704 mstwain32.exe 98 PID 1704 wrote to memory of 3932 1704 mstwain32.exe 98 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cbdba902238db9a376fa17f3abd9746.exe"C:\Users\Admin\AppData\Local\Temp\8cbdba902238db9a376fa17f3abd9746.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\8cbdba902238db9a376fa17f3abd9746.exeC:\Users\Admin\AppData\Local\Temp\8cbdba902238db9a376fa17f3abd9746.exe2⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\8cbdba902238db9a376fa17f3abd9746.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\mstwain32.exeC:\Windows\mstwain32.exe4⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3932
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3076
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD51c5069f3197f862af4182c3d5868c532
SHA1244cee10d96aa9f3ea8f0a43476f01fbdeaf98ce
SHA2563e5d3f20f1bb8b918e65a9a9c875a2ecdbccf5d7cf480bcd20f9b715874825d5
SHA512b47e48a42854d8e0924a756d9cb24a14b6e214d2b49f358d73231fc8edca0d02ae982cc68b2b5426c6269c98d30415396d20c6c08c2e894371648b395dae235e
-
Filesize
222KB
MD58cbdba902238db9a376fa17f3abd9746
SHA1e5d9838a6646395558cb4f3f8dc036b90a678afd
SHA256ae752871d3a8aed991f07ba17a880aab46fb9d254cc7db35cd9c1a90cb86b41f
SHA5126dd9d92b09ffba92ea72713105c8e0822c006154b644668298c0872b22f6ced1725005e5e80ed3ba838f18400f1c0dfbb886e7f3235287cfecc3a1cdb3cd803a
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350