Analysis
-
max time kernel
146s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/03/2024, 15:38
Behavioral task
behavioral1
Sample
de5afc5cb0c85953755615bfa7045872.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
de5afc5cb0c85953755615bfa7045872.exe
Resource
win10v2004-20240226-en
General
-
Target
de5afc5cb0c85953755615bfa7045872.exe
-
Size
231KB
-
MD5
de5afc5cb0c85953755615bfa7045872
-
SHA1
7dd4cd6e5012ce741037ba5e6db075266bdf4bd0
-
SHA256
c9af8c4076e6f206b253ef06870b89dfd197c76003cc2ddd7915eeda7cd68e70
-
SHA512
5bcb219a836a82071809dae8dd0767d0bc086032d5903363da97b8bd319a38239afbf38bce1de0118b759486707dfa5c5a9f8d00526856c99d054af55e6ab257
-
SSDEEP
3072:7Gvo6giwpW9DGD2VdKvY/gIg/CtTIuOmxkiozXgeXdHwTBf4Wgczc+0ieV53:7G377xS2Vp2CeiorXdwTBgWx4V53
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" deneme.exe -
ModiLoader Second Stage 16 IoCs
resource yara_rule behavioral1/files/0x000f000000012241-7.dat modiloader_stage2 behavioral1/memory/2844-8-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral1/memory/2796-13-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral1/memory/2796-14-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral1/memory/2796-15-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral1/memory/2796-16-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral1/memory/2796-17-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral1/memory/2796-18-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral1/memory/2796-19-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral1/memory/2796-20-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral1/memory/2796-21-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral1/memory/2796-22-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral1/memory/2796-23-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral1/memory/2796-24-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral1/memory/2796-25-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral1/memory/2796-26-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 2796 deneme.exe -
Executes dropped EXE 1 IoCs
pid Process 2796 deneme.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\deneme = "C:\\Windows\\deneme.exe" deneme.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA deneme.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" deneme.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA de5afc5cb0c85953755615bfa7045872.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\deneme.exe de5afc5cb0c85953755615bfa7045872.exe File opened for modification C:\Windows\deneme.exe de5afc5cb0c85953755615bfa7045872.exe File created C:\Windows\ntdtcstp.dll deneme.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2844 de5afc5cb0c85953755615bfa7045872.exe Token: SeDebugPrivilege 2796 deneme.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2796 deneme.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2844 wrote to memory of 2796 2844 de5afc5cb0c85953755615bfa7045872.exe 28 PID 2844 wrote to memory of 2796 2844 de5afc5cb0c85953755615bfa7045872.exe 28 PID 2844 wrote to memory of 2796 2844 de5afc5cb0c85953755615bfa7045872.exe 28 PID 2844 wrote to memory of 2796 2844 de5afc5cb0c85953755615bfa7045872.exe 28 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" deneme.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de5afc5cb0c85953755615bfa7045872.exe"C:\Users\Admin\AppData\Local\Temp\de5afc5cb0c85953755615bfa7045872.exe"1⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\deneme.exe"C:\Windows\deneme.exe" \melt "C:\Users\Admin\AppData\Local\Temp\de5afc5cb0c85953755615bfa7045872.exe"2⤵
- UAC bypass
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2796
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231KB
MD5de5afc5cb0c85953755615bfa7045872
SHA17dd4cd6e5012ce741037ba5e6db075266bdf4bd0
SHA256c9af8c4076e6f206b253ef06870b89dfd197c76003cc2ddd7915eeda7cd68e70
SHA5125bcb219a836a82071809dae8dd0767d0bc086032d5903363da97b8bd319a38239afbf38bce1de0118b759486707dfa5c5a9f8d00526856c99d054af55e6ab257