Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/02/2024, 20:36
Behavioral task
behavioral1
Sample
9018af484cddf39dd73bd87095602d52.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9018af484cddf39dd73bd87095602d52.exe
Resource
win10v2004-20231215-en
General
-
Target
9018af484cddf39dd73bd87095602d52.exe
-
Size
108KB
-
MD5
9018af484cddf39dd73bd87095602d52
-
SHA1
dea4559ee290fe3371a4ced25e7d3fd0c8c7f34b
-
SHA256
67398d52c60aeb43be4a9923d154d0347e7250299e13c786aae9dc3cf23af7b1
-
SHA512
230ea827ded8af9fb394acfc49b071a2179ea3cdbe0cef932009c530947b77ecf4097464b9790d421568ef28374e2d23a1fb72a0a75a339ad7f1083b3ecb6b22
-
SSDEEP
3072:hoy8j7VnNdrPHaSekwi+mW+2W5Z35out:x8jZ7rvaU3+mWrcToS
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 17 IoCs
resource yara_rule behavioral1/memory/1752-8-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1876-11-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1876-21-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1876-22-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1876-23-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1876-24-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1876-25-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1876-26-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1876-27-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1876-28-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1876-29-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1876-30-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1876-31-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1876-32-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1876-33-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1876-34-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral1/memory/1876-35-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 1876 mstwain32.exe -
resource yara_rule behavioral1/memory/1752-0-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/files/0x000a00000001225c-5.dat upx behavioral1/memory/1752-8-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1876-11-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1876-21-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1876-22-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1876-23-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1876-24-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1876-25-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1876-26-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1876-27-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1876-28-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1876-29-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1876-30-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1876-31-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1876-32-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1876-33-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1876-34-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1876-35-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 9018af484cddf39dd73bd87095602d52.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe File created C:\Windows\mstwain32.exe 9018af484cddf39dd73bd87095602d52.exe File opened for modification C:\Windows\mstwain32.exe 9018af484cddf39dd73bd87095602d52.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1752 9018af484cddf39dd73bd87095602d52.exe Token: SeDebugPrivilege 1876 mstwain32.exe Token: SeDebugPrivilege 1876 mstwain32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1876 mstwain32.exe 1876 mstwain32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1752 wrote to memory of 1876 1752 9018af484cddf39dd73bd87095602d52.exe 28 PID 1752 wrote to memory of 1876 1752 9018af484cddf39dd73bd87095602d52.exe 28 PID 1752 wrote to memory of 1876 1752 9018af484cddf39dd73bd87095602d52.exe 28 PID 1752 wrote to memory of 1876 1752 9018af484cddf39dd73bd87095602d52.exe 28 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9018af484cddf39dd73bd87095602d52.exe"C:\Users\Admin\AppData\Local\Temp\9018af484cddf39dd73bd87095602d52.exe"1⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1876
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD59018af484cddf39dd73bd87095602d52
SHA1dea4559ee290fe3371a4ced25e7d3fd0c8c7f34b
SHA25667398d52c60aeb43be4a9923d154d0347e7250299e13c786aae9dc3cf23af7b1
SHA512230ea827ded8af9fb394acfc49b071a2179ea3cdbe0cef932009c530947b77ecf4097464b9790d421568ef28374e2d23a1fb72a0a75a339ad7f1083b3ecb6b22