Analysis
-
max time kernel
145s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
01-01-2025 19:40
General
-
Target
denemm.exe
-
Size
295KB
-
MD5
7789ef88a6fa2c4ef1613ff3193dbd06
-
SHA1
32112ad860eeb69e516939390d69129f24012dd1
-
SHA256
deec0fbcac5bd01d0894906b62654d6d9475bfc2890970cd4c972529aa609d6e
-
SHA512
c6c902c989afe8df35de5101c3e69fb4f107a28c4f4e073db31ff77677bd3cbbf2aa6b30d44c9f2326edc11bab979c42c379c2958813b17726c66f12041e4bcc
-
SSDEEP
6144:RZq5p6OTPiSS/KsKHPWE8auRg0x2hZD0xlPoVeavupI:3q5LPiSDHPWE8TRg0xkl0xCVWpI
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
UAC bypass 3 TTPs 1 IoCs
-
ModiLoader Second Stage 15 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\denemm.exe"C:\Users\Admin\AppData\Local\Temp\denemm.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
271KB
MD5de4cd779cf278a9c6a37b27ae15b1754
SHA18d49214acadb2f91aca2a4c5bb207b0373dbd500
SHA256388a722a5eeb67f51f3e8a46800544571b5cd9138dcd17e97cb511e6beae43b2
SHA5126477297276465726d7b8f7bae0388d5e119bce163378ef814bf513f74dabe375bcf14d38af5955dc2e9dca7a375a82e78f7e8ff6f200724ce64f39f9a28e1c01
-
Filesize
40KB
MD53f689ab34ba20ffbc647f3c4ce7c9c92
SHA10275be6c5d43a4916f4b6b2b4aa06398e193206f
SHA256003eb1ba56dc99c6a6d4e8f35233edcee64aa8001ac5f7289369cae2325ff019
SHA5125336b3d410c21746a81a67c1b0da791d5592d4dc42fe559bc9b12a89b6bc6aef04b385a1566e55a7599c2489741ee7b0953f9cb0b3b5b9a9feb006678e2bdbce
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB