Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2024, 15:38
Behavioral task
behavioral1
Sample
de5afc5cb0c85953755615bfa7045872.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
de5afc5cb0c85953755615bfa7045872.exe
Resource
win10v2004-20240226-en
General
-
Target
de5afc5cb0c85953755615bfa7045872.exe
-
Size
231KB
-
MD5
de5afc5cb0c85953755615bfa7045872
-
SHA1
7dd4cd6e5012ce741037ba5e6db075266bdf4bd0
-
SHA256
c9af8c4076e6f206b253ef06870b89dfd197c76003cc2ddd7915eeda7cd68e70
-
SHA512
5bcb219a836a82071809dae8dd0767d0bc086032d5903363da97b8bd319a38239afbf38bce1de0118b759486707dfa5c5a9f8d00526856c99d054af55e6ab257
-
SSDEEP
3072:7Gvo6giwpW9DGD2VdKvY/gIg/CtTIuOmxkiozXgeXdHwTBf4Wgczc+0ieV53:7G377xS2Vp2CeiorXdwTBgWx4V53
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" deneme.exe -
ModiLoader Second Stage 16 IoCs
resource yara_rule behavioral2/files/0x000400000002271f-4.dat modiloader_stage2 behavioral2/memory/4484-9-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral2/memory/4748-18-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral2/memory/4748-20-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral2/memory/4748-22-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral2/memory/4748-24-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral2/memory/4748-26-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral2/memory/4748-28-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral2/memory/4748-30-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral2/memory/4748-32-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral2/memory/4748-34-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral2/memory/4748-36-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral2/memory/4748-38-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral2/memory/4748-40-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral2/memory/4748-42-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 behavioral2/memory/4748-44-0x0000000000400000-0x0000000000441000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation de5afc5cb0c85953755615bfa7045872.exe -
Deletes itself 1 IoCs
pid Process 4748 deneme.exe -
Executes dropped EXE 1 IoCs
pid Process 4748 deneme.exe -
Loads dropped DLL 2 IoCs
pid Process 4748 deneme.exe 4748 deneme.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deneme = "C:\\Windows\\deneme.exe" deneme.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA de5afc5cb0c85953755615bfa7045872.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA deneme.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" deneme.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\deneme.exe de5afc5cb0c85953755615bfa7045872.exe File opened for modification C:\Windows\deneme.exe de5afc5cb0c85953755615bfa7045872.exe File created C:\Windows\ntdtcstp.dll deneme.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4484 de5afc5cb0c85953755615bfa7045872.exe Token: SeDebugPrivilege 4748 deneme.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4748 deneme.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4484 wrote to memory of 4748 4484 de5afc5cb0c85953755615bfa7045872.exe 99 PID 4484 wrote to memory of 4748 4484 de5afc5cb0c85953755615bfa7045872.exe 99 PID 4484 wrote to memory of 4748 4484 de5afc5cb0c85953755615bfa7045872.exe 99 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" deneme.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de5afc5cb0c85953755615bfa7045872.exe"C:\Users\Admin\AppData\Local\Temp\de5afc5cb0c85953755615bfa7045872.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\deneme.exe"C:\Windows\deneme.exe" \melt "C:\Users\Admin\AppData\Local\Temp\de5afc5cb0c85953755615bfa7045872.exe"2⤵
- UAC bypass
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵PID:1680
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231KB
MD5de5afc5cb0c85953755615bfa7045872
SHA17dd4cd6e5012ce741037ba5e6db075266bdf4bd0
SHA256c9af8c4076e6f206b253ef06870b89dfd197c76003cc2ddd7915eeda7cd68e70
SHA5125bcb219a836a82071809dae8dd0767d0bc086032d5903363da97b8bd319a38239afbf38bce1de0118b759486707dfa5c5a9f8d00526856c99d054af55e6ab257
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350