Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 20:36
Behavioral task
behavioral1
Sample
9018af484cddf39dd73bd87095602d52.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9018af484cddf39dd73bd87095602d52.exe
Resource
win10v2004-20231215-en
General
-
Target
9018af484cddf39dd73bd87095602d52.exe
-
Size
108KB
-
MD5
9018af484cddf39dd73bd87095602d52
-
SHA1
dea4559ee290fe3371a4ced25e7d3fd0c8c7f34b
-
SHA256
67398d52c60aeb43be4a9923d154d0347e7250299e13c786aae9dc3cf23af7b1
-
SHA512
230ea827ded8af9fb394acfc49b071a2179ea3cdbe0cef932009c530947b77ecf4097464b9790d421568ef28374e2d23a1fb72a0a75a339ad7f1083b3ecb6b22
-
SSDEEP
3072:hoy8j7VnNdrPHaSekwi+mW+2W5Z35out:x8jZ7rvaU3+mWrcToS
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 16 IoCs
resource yara_rule behavioral2/memory/5064-11-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/876-25-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/876-28-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/876-31-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/876-32-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/876-35-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/876-38-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/876-41-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/876-44-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/876-47-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/876-50-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/876-53-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/876-56-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/876-59-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/876-62-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 behavioral2/memory/876-65-0x0000000000400000-0x0000000000450000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 9018af484cddf39dd73bd87095602d52.exe -
Executes dropped EXE 1 IoCs
pid Process 876 mstwain32.exe -
Loads dropped DLL 4 IoCs
pid Process 876 mstwain32.exe 876 mstwain32.exe 876 mstwain32.exe 876 mstwain32.exe -
resource yara_rule behavioral2/memory/5064-0-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/files/0x0007000000023100-5.dat upx behavioral2/memory/5064-11-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/876-25-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/876-28-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/876-31-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/876-32-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/876-35-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/876-38-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/876-41-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/876-44-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/876-47-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/876-50-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/876-53-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/876-56-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/876-59-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/876-62-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/876-65-0x0000000000400000-0x0000000000450000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 9018af484cddf39dd73bd87095602d52.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\mstwain32.exe 9018af484cddf39dd73bd87095602d52.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe File created C:\Windows\mstwain32.exe 9018af484cddf39dd73bd87095602d52.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5064 9018af484cddf39dd73bd87095602d52.exe Token: SeDebugPrivilege 876 mstwain32.exe Token: SeDebugPrivilege 876 mstwain32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 876 mstwain32.exe 876 mstwain32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5064 wrote to memory of 876 5064 9018af484cddf39dd73bd87095602d52.exe 84 PID 5064 wrote to memory of 876 5064 9018af484cddf39dd73bd87095602d52.exe 84 PID 5064 wrote to memory of 876 5064 9018af484cddf39dd73bd87095602d52.exe 84 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9018af484cddf39dd73bd87095602d52.exe"C:\Users\Admin\AppData\Local\Temp\9018af484cddf39dd73bd87095602d52.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:876
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD5965df136f0cea9286441f242d3e36624
SHA1688ff39d76aaa43cdd44aab17ebf16a764648ad1
SHA25672bef3c45889a83ef384ddc171f4d47f994042bd8380109c6ef3bb7f7263050a
SHA512a19387c4501457fddd84129414054c78d01ffed5342f7bcfc90cfaf2e966aaac0b2124a2b6e23cd03c58f76e8b1bd1ed38d9cc08eff7d9fa6ee56252a8f51205
-
Filesize
108KB
MD59018af484cddf39dd73bd87095602d52
SHA1dea4559ee290fe3371a4ced25e7d3fd0c8c7f34b
SHA25667398d52c60aeb43be4a9923d154d0347e7250299e13c786aae9dc3cf23af7b1
SHA512230ea827ded8af9fb394acfc49b071a2179ea3cdbe0cef932009c530947b77ecf4097464b9790d421568ef28374e2d23a1fb72a0a75a339ad7f1083b3ecb6b22
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350