Analysis

  • max time kernel
    142s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/03/2024, 16:54

General

  • Target

    de7da11f23c0d9763fdd5c9676edf858.exe

  • Size

    1.3MB

  • MD5

    de7da11f23c0d9763fdd5c9676edf858

  • SHA1

    1ce0e8ce70c5e9e5d45dc18fd4f938e41e1caf72

  • SHA256

    a17f3767047a98aa7cd819151c97ec119548ae5379f481fb4500e912ae3375a9

  • SHA512

    45257eb0f9aeedb1951fc4ad13c5571df78ae63c1a3183d227c7152bcb4f68f728de69d6dc7a45a541236b016a167be52c4a7df0afc3066843f46d5231fa7638

  • SSDEEP

    24576:nTn0kqBN3lqHWd7fv/YpF7hdEQZBbwOThv81O5BWjRbkQJTMTRBVvvfkn6qiYob:olld7/YL9d9BbPu1Ob0beTbVvvfkMY

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • UAC bypass 3 TTPs 1 IoCs
  • ModiLoader Second Stage 19 IoCs
  • Executes dropped EXE 1 IoCs
  • Themida packer 20 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • System policy modification 1 TTPs 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\de7da11f23c0d9763fdd5c9676edf858.exe
    "C:\Users\Admin\AppData\Local\Temp\de7da11f23c0d9763fdd5c9676edf858.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\Windows\mstwain32.exe
      "C:\Windows\mstwain32.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:1420
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2500

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\mstwain32.exe

          Filesize

          1.3MB

          MD5

          de7da11f23c0d9763fdd5c9676edf858

          SHA1

          1ce0e8ce70c5e9e5d45dc18fd4f938e41e1caf72

          SHA256

          a17f3767047a98aa7cd819151c97ec119548ae5379f481fb4500e912ae3375a9

          SHA512

          45257eb0f9aeedb1951fc4ad13c5571df78ae63c1a3183d227c7152bcb4f68f728de69d6dc7a45a541236b016a167be52c4a7df0afc3066843f46d5231fa7638

        • memory/1420-62-0x0000000004460000-0x0000000004461000-memory.dmp

          Filesize

          4KB

        • memory/1420-61-0x0000000075640000-0x0000000075654000-memory.dmp

          Filesize

          80KB

        • memory/1420-80-0x0000000000400000-0x00000000006A9000-memory.dmp

          Filesize

          2.7MB

        • memory/1420-79-0x0000000000400000-0x00000000006A9000-memory.dmp

          Filesize

          2.7MB

        • memory/1420-47-0x0000000004380000-0x0000000004381000-memory.dmp

          Filesize

          4KB

        • memory/1420-78-0x0000000000400000-0x00000000006A9000-memory.dmp

          Filesize

          2.7MB

        • memory/1420-77-0x0000000000400000-0x00000000006A9000-memory.dmp

          Filesize

          2.7MB

        • memory/1420-76-0x0000000000400000-0x00000000006A9000-memory.dmp

          Filesize

          2.7MB

        • memory/1420-75-0x0000000000400000-0x00000000006A9000-memory.dmp

          Filesize

          2.7MB

        • memory/1420-74-0x0000000000400000-0x00000000006A9000-memory.dmp

          Filesize

          2.7MB

        • memory/1420-73-0x0000000000400000-0x00000000006A9000-memory.dmp

          Filesize

          2.7MB

        • memory/1420-72-0x0000000000400000-0x00000000006A9000-memory.dmp

          Filesize

          2.7MB

        • memory/1420-70-0x0000000000400000-0x00000000006A9000-memory.dmp

          Filesize

          2.7MB

        • memory/1420-44-0x00000000043E0000-0x00000000043E1000-memory.dmp

          Filesize

          4KB

        • memory/1420-68-0x0000000075E10000-0x0000000075F00000-memory.dmp

          Filesize

          960KB

        • memory/1420-67-0x0000000000400000-0x00000000006A9000-memory.dmp

          Filesize

          2.7MB

        • memory/1420-66-0x0000000000400000-0x00000000006A9000-memory.dmp

          Filesize

          2.7MB

        • memory/1420-65-0x0000000000270000-0x0000000000271000-memory.dmp

          Filesize

          4KB

        • memory/1420-64-0x0000000000400000-0x00000000006A9000-memory.dmp

          Filesize

          2.7MB

        • memory/1420-63-0x0000000004980000-0x0000000004981000-memory.dmp

          Filesize

          4KB

        • memory/1420-60-0x0000000075E10000-0x0000000075F00000-memory.dmp

          Filesize

          960KB

        • memory/1420-52-0x00000000049D0000-0x00000000049DE000-memory.dmp

          Filesize

          56KB

        • memory/1420-31-0x0000000000270000-0x0000000000271000-memory.dmp

          Filesize

          4KB

        • memory/1420-53-0x00000000044B0000-0x00000000044B1000-memory.dmp

          Filesize

          4KB

        • memory/1420-32-0x0000000000400000-0x00000000006A9000-memory.dmp

          Filesize

          2.7MB

        • memory/1420-33-0x0000000004330000-0x0000000004331000-memory.dmp

          Filesize

          4KB

        • memory/1420-43-0x0000000004480000-0x0000000004481000-memory.dmp

          Filesize

          4KB

        • memory/1420-45-0x0000000004400000-0x0000000004401000-memory.dmp

          Filesize

          4KB

        • memory/1420-51-0x0000000004360000-0x0000000004361000-memory.dmp

          Filesize

          4KB

        • memory/1420-50-0x0000000004440000-0x0000000004441000-memory.dmp

          Filesize

          4KB

        • memory/1420-49-0x00000000044A0000-0x00000000044A1000-memory.dmp

          Filesize

          4KB

        • memory/1420-48-0x0000000004340000-0x0000000004341000-memory.dmp

          Filesize

          4KB

        • memory/1420-54-0x0000000004470000-0x0000000004471000-memory.dmp

          Filesize

          4KB

        • memory/1420-42-0x00000000043C0000-0x00000000043C1000-memory.dmp

          Filesize

          4KB

        • memory/1420-69-0x0000000000400000-0x00000000006A9000-memory.dmp

          Filesize

          2.7MB

        • memory/1420-46-0x0000000004370000-0x0000000004371000-memory.dmp

          Filesize

          4KB

        • memory/1420-41-0x00000000043B0000-0x00000000043B1000-memory.dmp

          Filesize

          4KB

        • memory/1420-40-0x0000000004490000-0x0000000004491000-memory.dmp

          Filesize

          4KB

        • memory/1420-38-0x0000000004390000-0x0000000004391000-memory.dmp

          Filesize

          4KB

        • memory/1420-37-0x0000000004300000-0x0000000004301000-memory.dmp

          Filesize

          4KB

        • memory/1420-34-0x0000000004350000-0x0000000004351000-memory.dmp

          Filesize

          4KB

        • memory/1420-59-0x0000000004450000-0x0000000004451000-memory.dmp

          Filesize

          4KB

        • memory/1420-58-0x0000000004160000-0x0000000004161000-memory.dmp

          Filesize

          4KB

        • memory/1420-57-0x00000000043D0000-0x00000000043D1000-memory.dmp

          Filesize

          4KB

        • memory/1420-56-0x0000000004430000-0x0000000004431000-memory.dmp

          Filesize

          4KB

        • memory/1780-0-0x0000000000840000-0x0000000000841000-memory.dmp

          Filesize

          4KB

        • memory/1780-3-0x0000000004330000-0x0000000004331000-memory.dmp

          Filesize

          4KB

        • memory/1780-1-0x00000000009A0000-0x0000000000A89000-memory.dmp

          Filesize

          932KB

        • memory/1780-21-0x0000000000400000-0x00000000006A9000-memory.dmp

          Filesize

          2.7MB

        • memory/1780-2-0x0000000000400000-0x00000000006A9000-memory.dmp

          Filesize

          2.7MB

        • memory/1780-6-0x0000000004390000-0x0000000004391000-memory.dmp

          Filesize

          4KB

        • memory/1780-19-0x0000000004420000-0x0000000004422000-memory.dmp

          Filesize

          8KB

        • memory/1780-9-0x00000000043C0000-0x00000000043C1000-memory.dmp

          Filesize

          4KB

        • memory/1780-12-0x0000000004400000-0x0000000004401000-memory.dmp

          Filesize

          4KB

        • memory/1780-18-0x0000000004360000-0x0000000004361000-memory.dmp

          Filesize

          4KB

        • memory/1780-30-0x0000000000400000-0x00000000006A9000-memory.dmp

          Filesize

          2.7MB

        • memory/1780-5-0x0000000004300000-0x0000000004301000-memory.dmp

          Filesize

          4KB

        • memory/1780-20-0x00000000043D0000-0x00000000043D1000-memory.dmp

          Filesize

          4KB

        • memory/1780-10-0x0000000004470000-0x0000000004471000-memory.dmp

          Filesize

          4KB

        • memory/1780-11-0x00000000043E0000-0x00000000043E1000-memory.dmp

          Filesize

          4KB

        • memory/1780-8-0x00000000043B0000-0x00000000043B1000-memory.dmp

          Filesize

          4KB

        • memory/1780-13-0x0000000004380000-0x0000000004381000-memory.dmp

          Filesize

          4KB

        • memory/1780-14-0x0000000004340000-0x0000000004341000-memory.dmp

          Filesize

          4KB

        • memory/1780-15-0x0000000004490000-0x0000000004491000-memory.dmp

          Filesize

          4KB

        • memory/1780-16-0x0000000004430000-0x0000000004431000-memory.dmp

          Filesize

          4KB

        • memory/1780-17-0x0000000004370000-0x0000000004371000-memory.dmp

          Filesize

          4KB

        • memory/1780-7-0x0000000004480000-0x0000000004481000-memory.dmp

          Filesize

          4KB

        • memory/1780-4-0x0000000004350000-0x0000000004351000-memory.dmp

          Filesize

          4KB