Analysis
-
max time kernel
143s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-06-2024 01:13
Static task
static1
Behavioral task
behavioral1
Sample
00a3f4fca136f952348fd925d1880069.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
00a3f4fca136f952348fd925d1880069.exe
Resource
win10v2004-20240611-en
General
-
Target
00a3f4fca136f952348fd925d1880069.exe
-
Size
1012KB
-
MD5
00a3f4fca136f952348fd925d1880069
-
SHA1
13971320aa89d7e0ae9f5c5c21f353df4714602b
-
SHA256
4864533bba0db0560b6655a97d2804dbf081a02ca038240a3c9262e86842864e
-
SHA512
178490f992fb50d00cdb7f70369d865e1286655146b4e5f9e70ea3680a0818da3c95dfa9d9af553878a8b6c57c577b512bdf558dcbe84674bff80e101be83dae
-
SSDEEP
24576:iJ7XN2EWmqUvZBfiGBOHms/QKHemrtynTdq1ROGv:IN2QZNq/niM1Q
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
ModiLoader Second Stage 23 IoCs
Processes:
resource yara_rule behavioral1/memory/1984-1-0x0000000000401000-0x000000000041C000-memory.dmp modiloader_stage2 behavioral1/memory/1984-14-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-16-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-22-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-23-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-24-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-25-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-28-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-29-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-30-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-33-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-34-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-37-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-40-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-44-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-47-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-50-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-53-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-56-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-59-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-62-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-65-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 behavioral1/memory/1040-68-0x0000000000400000-0x0000000000529000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
mstwain32.exepid process 1040 mstwain32.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
00a3f4fca136f952348fd925d1880069.exemstwain32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Wine 00a3f4fca136f952348fd925d1880069.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Wine mstwain32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
mstwain32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe" mstwain32.exe -
Processes:
00a3f4fca136f952348fd925d1880069.exemstwain32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 00a3f4fca136f952348fd925d1880069.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mstwain32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Drops file in Windows directory 4 IoCs
Processes:
mstwain32.exe00a3f4fca136f952348fd925d1880069.exedescription ioc process File created C:\Windows\ntdtcstp.dll mstwain32.exe File created C:\Windows\cmsetac.dll mstwain32.exe File created C:\Windows\mstwain32.exe 00a3f4fca136f952348fd925d1880069.exe File opened for modification C:\Windows\mstwain32.exe 00a3f4fca136f952348fd925d1880069.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
00a3f4fca136f952348fd925d1880069.exevssvc.exemstwain32.exedescription pid process Token: SeDebugPrivilege 1984 00a3f4fca136f952348fd925d1880069.exe Token: SeBackupPrivilege 2560 vssvc.exe Token: SeRestorePrivilege 2560 vssvc.exe Token: SeAuditPrivilege 2560 vssvc.exe Token: SeDebugPrivilege 1040 mstwain32.exe Token: SeDebugPrivilege 1040 mstwain32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mstwain32.exepid process 1040 mstwain32.exe 1040 mstwain32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
00a3f4fca136f952348fd925d1880069.exedescription pid process target process PID 1984 wrote to memory of 1040 1984 00a3f4fca136f952348fd925d1880069.exe mstwain32.exe PID 1984 wrote to memory of 1040 1984 00a3f4fca136f952348fd925d1880069.exe mstwain32.exe PID 1984 wrote to memory of 1040 1984 00a3f4fca136f952348fd925d1880069.exe mstwain32.exe PID 1984 wrote to memory of 1040 1984 00a3f4fca136f952348fd925d1880069.exe mstwain32.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
mstwain32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\00a3f4fca136f952348fd925d1880069.exe"C:\Users\Admin\AppData\Local\Temp\00a3f4fca136f952348fd925d1880069.exe"1⤵
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\mstwain32.exe"C:\Windows\mstwain32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1040
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2560
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1012KB
MD500a3f4fca136f952348fd925d1880069
SHA113971320aa89d7e0ae9f5c5c21f353df4714602b
SHA2564864533bba0db0560b6655a97d2804dbf081a02ca038240a3c9262e86842864e
SHA512178490f992fb50d00cdb7f70369d865e1286655146b4e5f9e70ea3680a0818da3c95dfa9d9af553878a8b6c57c577b512bdf558dcbe84674bff80e101be83dae