Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/03/2024, 16:54
Behavioral task
behavioral1
Sample
de7da11f23c0d9763fdd5c9676edf858.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
de7da11f23c0d9763fdd5c9676edf858.exe
Resource
win10v2004-20240226-en
General
-
Target
de7da11f23c0d9763fdd5c9676edf858.exe
-
Size
1.3MB
-
MD5
de7da11f23c0d9763fdd5c9676edf858
-
SHA1
1ce0e8ce70c5e9e5d45dc18fd4f938e41e1caf72
-
SHA256
a17f3767047a98aa7cd819151c97ec119548ae5379f481fb4500e912ae3375a9
-
SHA512
45257eb0f9aeedb1951fc4ad13c5571df78ae63c1a3183d227c7152bcb4f68f728de69d6dc7a45a541236b016a167be52c4a7df0afc3066843f46d5231fa7638
-
SSDEEP
24576:nTn0kqBN3lqHWd7fv/YpF7hdEQZBbwOThv81O5BWjRbkQJTMTRBVvvfkn6qiYob:olld7/YL9d9BbPu1Ob0beTbVvvfkMY
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 19 IoCs
resource yara_rule behavioral1/memory/1780-2-0x0000000000400000-0x00000000006A9000-memory.dmp modiloader_stage2 behavioral1/memory/1780-21-0x0000000000400000-0x00000000006A9000-memory.dmp modiloader_stage2 behavioral1/memory/1780-30-0x0000000000400000-0x00000000006A9000-memory.dmp modiloader_stage2 behavioral1/memory/1420-32-0x0000000000400000-0x00000000006A9000-memory.dmp modiloader_stage2 behavioral1/memory/1420-60-0x0000000075E10000-0x0000000075F00000-memory.dmp modiloader_stage2 behavioral1/memory/1420-64-0x0000000000400000-0x00000000006A9000-memory.dmp modiloader_stage2 behavioral1/memory/1420-66-0x0000000000400000-0x00000000006A9000-memory.dmp modiloader_stage2 behavioral1/memory/1420-67-0x0000000000400000-0x00000000006A9000-memory.dmp modiloader_stage2 behavioral1/memory/1420-69-0x0000000000400000-0x00000000006A9000-memory.dmp modiloader_stage2 behavioral1/memory/1420-70-0x0000000000400000-0x00000000006A9000-memory.dmp modiloader_stage2 behavioral1/memory/1420-72-0x0000000000400000-0x00000000006A9000-memory.dmp modiloader_stage2 behavioral1/memory/1420-73-0x0000000000400000-0x00000000006A9000-memory.dmp modiloader_stage2 behavioral1/memory/1420-74-0x0000000000400000-0x00000000006A9000-memory.dmp modiloader_stage2 behavioral1/memory/1420-75-0x0000000000400000-0x00000000006A9000-memory.dmp modiloader_stage2 behavioral1/memory/1420-76-0x0000000000400000-0x00000000006A9000-memory.dmp modiloader_stage2 behavioral1/memory/1420-77-0x0000000000400000-0x00000000006A9000-memory.dmp modiloader_stage2 behavioral1/memory/1420-78-0x0000000000400000-0x00000000006A9000-memory.dmp modiloader_stage2 behavioral1/memory/1420-79-0x0000000000400000-0x00000000006A9000-memory.dmp modiloader_stage2 behavioral1/memory/1420-80-0x0000000000400000-0x00000000006A9000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 1420 mstwain32.exe -
resource yara_rule behavioral1/memory/1780-2-0x0000000000400000-0x00000000006A9000-memory.dmp themida behavioral1/memory/1780-21-0x0000000000400000-0x00000000006A9000-memory.dmp themida behavioral1/files/0x00060000000055d7-26.dat themida behavioral1/memory/1780-30-0x0000000000400000-0x00000000006A9000-memory.dmp themida behavioral1/memory/1420-32-0x0000000000400000-0x00000000006A9000-memory.dmp themida behavioral1/memory/1420-60-0x0000000075E10000-0x0000000075F00000-memory.dmp themida behavioral1/memory/1420-64-0x0000000000400000-0x00000000006A9000-memory.dmp themida behavioral1/memory/1420-66-0x0000000000400000-0x00000000006A9000-memory.dmp themida behavioral1/memory/1420-67-0x0000000000400000-0x00000000006A9000-memory.dmp themida behavioral1/memory/1420-69-0x0000000000400000-0x00000000006A9000-memory.dmp themida behavioral1/memory/1420-70-0x0000000000400000-0x00000000006A9000-memory.dmp themida behavioral1/memory/1420-72-0x0000000000400000-0x00000000006A9000-memory.dmp themida behavioral1/memory/1420-73-0x0000000000400000-0x00000000006A9000-memory.dmp themida behavioral1/memory/1420-74-0x0000000000400000-0x00000000006A9000-memory.dmp themida behavioral1/memory/1420-75-0x0000000000400000-0x00000000006A9000-memory.dmp themida behavioral1/memory/1420-76-0x0000000000400000-0x00000000006A9000-memory.dmp themida behavioral1/memory/1420-77-0x0000000000400000-0x00000000006A9000-memory.dmp themida behavioral1/memory/1420-78-0x0000000000400000-0x00000000006A9000-memory.dmp themida behavioral1/memory/1420-79-0x0000000000400000-0x00000000006A9000-memory.dmp themida behavioral1/memory/1420-80-0x0000000000400000-0x00000000006A9000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA de7da11f23c0d9763fdd5c9676edf858.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\mstwain32.exe de7da11f23c0d9763fdd5c9676edf858.exe File opened for modification C:\Windows\mstwain32.exe de7da11f23c0d9763fdd5c9676edf858.exe File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1780 de7da11f23c0d9763fdd5c9676edf858.exe 1420 mstwain32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1780 de7da11f23c0d9763fdd5c9676edf858.exe Token: SeBackupPrivilege 2500 vssvc.exe Token: SeRestorePrivilege 2500 vssvc.exe Token: SeAuditPrivilege 2500 vssvc.exe Token: SeDebugPrivilege 1420 mstwain32.exe Token: SeDebugPrivilege 1420 mstwain32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1420 mstwain32.exe 1420 mstwain32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1780 wrote to memory of 1420 1780 de7da11f23c0d9763fdd5c9676edf858.exe 31 PID 1780 wrote to memory of 1420 1780 de7da11f23c0d9763fdd5c9676edf858.exe 31 PID 1780 wrote to memory of 1420 1780 de7da11f23c0d9763fdd5c9676edf858.exe 31 PID 1780 wrote to memory of 1420 1780 de7da11f23c0d9763fdd5c9676edf858.exe 31 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\de7da11f23c0d9763fdd5c9676edf858.exe"C:\Users\Admin\AppData\Local\Temp\de7da11f23c0d9763fdd5c9676edf858.exe"1⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1420
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5de7da11f23c0d9763fdd5c9676edf858
SHA11ce0e8ce70c5e9e5d45dc18fd4f938e41e1caf72
SHA256a17f3767047a98aa7cd819151c97ec119548ae5379f481fb4500e912ae3375a9
SHA51245257eb0f9aeedb1951fc4ad13c5571df78ae63c1a3183d227c7152bcb4f68f728de69d6dc7a45a541236b016a167be52c4a7df0afc3066843f46d5231fa7638