Analysis

  • max time kernel
    145s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03/02/2024, 19:04

General

  • Target

    8d1b98911e753283e86aa1d84a2826d8.exe

  • Size

    1.3MB

  • MD5

    8d1b98911e753283e86aa1d84a2826d8

  • SHA1

    9229784e22dbe0e3064c41a0e1f886b915f6168f

  • SHA256

    46b5e0aa12026e4615bbbb5d4d243a5d7445de044a649bc94e7581a1d7b04e61

  • SHA512

    5c890395f5676801749a5810aca8237f988be5996ed6f742d085a12311b1e7964e5e9f211ae5fcb84c80e5cf08a5ad34006107c45f254875757a2aacad11343b

  • SSDEEP

    24576:/hNCxhaAnl/gA4GorqG+or8UNii/6wIjDWscgie+QjAR:/hQcWopGMT8wNPIjggi+8

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • UAC bypass 3 TTPs 1 IoCs
  • ModiLoader Second Stage 20 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Themida packer 21 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • System policy modification 1 TTPs 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d1b98911e753283e86aa1d84a2826d8.exe
    "C:\Users\Admin\AppData\Local\Temp\8d1b98911e753283e86aa1d84a2826d8.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Windows\mstwain32.exe
      "C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\8d1b98911e753283e86aa1d84a2826d8.exe"
      2⤵
      • UAC bypass
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:1656
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3052

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\mstwain32.exe

          Filesize

          1.3MB

          MD5

          8d1b98911e753283e86aa1d84a2826d8

          SHA1

          9229784e22dbe0e3064c41a0e1f886b915f6168f

          SHA256

          46b5e0aa12026e4615bbbb5d4d243a5d7445de044a649bc94e7581a1d7b04e61

          SHA512

          5c890395f5676801749a5810aca8237f988be5996ed6f742d085a12311b1e7964e5e9f211ae5fcb84c80e5cf08a5ad34006107c45f254875757a2aacad11343b

        • memory/1656-53-0x00000000043D0000-0x00000000043D2000-memory.dmp

          Filesize

          8KB

        • memory/1656-39-0x0000000000400000-0x000000000069E000-memory.dmp

          Filesize

          2.6MB

        • memory/1656-86-0x0000000000400000-0x000000000069E000-memory.dmp

          Filesize

          2.6MB

        • memory/1656-85-0x0000000000400000-0x000000000069E000-memory.dmp

          Filesize

          2.6MB

        • memory/1656-84-0x0000000000400000-0x000000000069E000-memory.dmp

          Filesize

          2.6MB

        • memory/1656-83-0x0000000000400000-0x000000000069E000-memory.dmp

          Filesize

          2.6MB

        • memory/1656-82-0x0000000000400000-0x000000000069E000-memory.dmp

          Filesize

          2.6MB

        • memory/1656-81-0x0000000000400000-0x000000000069E000-memory.dmp

          Filesize

          2.6MB

        • memory/1656-80-0x0000000000400000-0x000000000069E000-memory.dmp

          Filesize

          2.6MB

        • memory/1656-79-0x0000000000400000-0x000000000069E000-memory.dmp

          Filesize

          2.6MB

        • memory/1656-43-0x0000000004380000-0x0000000004381000-memory.dmp

          Filesize

          4KB

        • memory/1656-78-0x0000000000400000-0x000000000069E000-memory.dmp

          Filesize

          2.6MB

        • memory/1656-76-0x0000000000400000-0x000000000069E000-memory.dmp

          Filesize

          2.6MB

        • memory/1656-75-0x0000000000400000-0x000000000069E000-memory.dmp

          Filesize

          2.6MB

        • memory/1656-74-0x00000000761D0000-0x00000000762C0000-memory.dmp

          Filesize

          960KB

        • memory/1656-73-0x0000000000400000-0x000000000069E000-memory.dmp

          Filesize

          2.6MB

        • memory/1656-72-0x0000000000400000-0x000000000069E000-memory.dmp

          Filesize

          2.6MB

        • memory/1656-71-0x0000000000840000-0x0000000000841000-memory.dmp

          Filesize

          4KB

        • memory/1656-70-0x0000000000400000-0x000000000069E000-memory.dmp

          Filesize

          2.6MB

        • memory/1656-69-0x0000000004950000-0x0000000004951000-memory.dmp

          Filesize

          4KB

        • memory/1656-68-0x00000000761D0000-0x00000000762C0000-memory.dmp

          Filesize

          960KB

        • memory/1656-40-0x00000000041E0000-0x00000000041E1000-memory.dmp

          Filesize

          4KB

        • memory/1656-54-0x0000000004370000-0x0000000004371000-memory.dmp

          Filesize

          4KB

        • memory/1656-55-0x00000000043E0000-0x00000000043E1000-memory.dmp

          Filesize

          4KB

        • memory/1656-56-0x00000000044D0000-0x00000000044D1000-memory.dmp

          Filesize

          4KB

        • memory/1656-57-0x0000000004420000-0x0000000004421000-memory.dmp

          Filesize

          4KB

        • memory/1656-58-0x0000000004220000-0x0000000004221000-memory.dmp

          Filesize

          4KB

        • memory/1656-35-0x0000000000840000-0x0000000000841000-memory.dmp

          Filesize

          4KB

        • memory/1656-49-0x0000000004400000-0x0000000004401000-memory.dmp

          Filesize

          4KB

        • memory/1656-48-0x0000000004460000-0x0000000004461000-memory.dmp

          Filesize

          4KB

        • memory/1656-47-0x00000000043B0000-0x00000000043B2000-memory.dmp

          Filesize

          8KB

        • memory/1656-46-0x00000000043A0000-0x00000000043A1000-memory.dmp

          Filesize

          4KB

        • memory/1656-45-0x0000000004470000-0x0000000004471000-memory.dmp

          Filesize

          4KB

        • memory/1656-51-0x0000000004960000-0x000000000496E000-memory.dmp

          Filesize

          56KB

        • memory/1656-41-0x0000000004200000-0x0000000004201000-memory.dmp

          Filesize

          4KB

        • memory/1656-44-0x00000000044C0000-0x00000000044C1000-memory.dmp

          Filesize

          4KB

        • memory/1656-59-0x0000000004210000-0x0000000004211000-memory.dmp

          Filesize

          4KB

        • memory/1656-60-0x0000000004410000-0x0000000004411000-memory.dmp

          Filesize

          4KB

        • memory/1656-50-0x00000000043C0000-0x00000000043C1000-memory.dmp

          Filesize

          4KB

        • memory/1656-64-0x00000000044B0000-0x00000000044B1000-memory.dmp

          Filesize

          4KB

        • memory/1656-67-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

          Filesize

          4KB

        • memory/1656-66-0x00000000041F0000-0x00000000041F1000-memory.dmp

          Filesize

          4KB

        • memory/1656-65-0x00000000754A0000-0x00000000754B4000-memory.dmp

          Filesize

          80KB

        • memory/1656-63-0x0000000004450000-0x0000000004451000-memory.dmp

          Filesize

          4KB

        • memory/1656-62-0x0000000004430000-0x0000000004431000-memory.dmp

          Filesize

          4KB

        • memory/1656-61-0x0000000004490000-0x0000000004491000-memory.dmp

          Filesize

          4KB

        • memory/1656-42-0x00000000041B0000-0x00000000041B1000-memory.dmp

          Filesize

          4KB

        • memory/2196-16-0x0000000004360000-0x0000000004361000-memory.dmp

          Filesize

          4KB

        • memory/2196-18-0x00000000043C0000-0x00000000043C1000-memory.dmp

          Filesize

          4KB

        • memory/2196-32-0x0000000000270000-0x0000000000271000-memory.dmp

          Filesize

          4KB

        • memory/2196-6-0x0000000004380000-0x0000000004381000-memory.dmp

          Filesize

          4KB

        • memory/2196-1-0x0000000001EC0000-0x0000000001FA4000-memory.dmp

          Filesize

          912KB

        • memory/2196-25-0x0000000004430000-0x0000000004431000-memory.dmp

          Filesize

          4KB

        • memory/2196-0-0x0000000000270000-0x0000000000271000-memory.dmp

          Filesize

          4KB

        • memory/2196-22-0x0000000000400000-0x000000000069E000-memory.dmp

          Filesize

          2.6MB

        • memory/2196-2-0x0000000000400000-0x000000000069E000-memory.dmp

          Filesize

          2.6MB

        • memory/2196-21-0x0000000004110000-0x0000000004111000-memory.dmp

          Filesize

          4KB

        • memory/2196-20-0x00000000044B0000-0x00000000044B1000-memory.dmp

          Filesize

          4KB

        • memory/2196-7-0x0000000004490000-0x0000000004491000-memory.dmp

          Filesize

          4KB

        • memory/2196-34-0x0000000000400000-0x000000000069E000-memory.dmp

          Filesize

          2.6MB

        • memory/2196-4-0x0000000004340000-0x0000000004341000-memory.dmp

          Filesize

          4KB

        • memory/2196-12-0x00000000043F0000-0x00000000043F1000-memory.dmp

          Filesize

          4KB

        • memory/2196-8-0x00000000043A0000-0x00000000043A1000-memory.dmp

          Filesize

          4KB

        • memory/2196-9-0x00000000043B0000-0x00000000043B1000-memory.dmp

          Filesize

          4KB

        • memory/2196-10-0x0000000004480000-0x0000000004481000-memory.dmp

          Filesize

          4KB

        • memory/2196-11-0x00000000043D0000-0x00000000043D1000-memory.dmp

          Filesize

          4KB

        • memory/2196-13-0x0000000004370000-0x0000000004371000-memory.dmp

          Filesize

          4KB

        • memory/2196-14-0x0000000004330000-0x0000000004331000-memory.dmp

          Filesize

          4KB

        • memory/2196-15-0x0000000004440000-0x0000000004441000-memory.dmp

          Filesize

          4KB

        • memory/2196-5-0x00000000041B0000-0x00000000041B1000-memory.dmp

          Filesize

          4KB

        • memory/2196-17-0x0000000004350000-0x0000000004351000-memory.dmp

          Filesize

          4KB

        • memory/2196-33-0x0000000000400000-0x000000000069E000-memory.dmp

          Filesize

          2.6MB

        • memory/2196-19-0x0000000004420000-0x0000000004421000-memory.dmp

          Filesize

          4KB

        • memory/2196-3-0x0000000004320000-0x0000000004321000-memory.dmp

          Filesize

          4KB