modiloader | 883dd0e1d35a2446e2a2e87b44a79acde65947908dc9ecb1f1f6a5a5d15c0891

General

Target

883dd0e1d35a2446e2a2e87b44a79acde65947908dc9ecb1f1f6a5a5d15c0891.exe
Size

124KB
MD5

4f1312128ecb876a40f798b014bcdec6
SHA1

18a60b4bba15ffbb80a24cd4d94cd07fff033f4a
SHA256

883dd0e1d35a2446e2a2e87b44a79acde65947908dc9ecb1f1f6a5a5d15c0891
SHA512

6a889eb4dcc04bf034b30dfaa24b1eab187c467177b3953f933283a8b271bddb94854114e931ff3e238c14f70178859a78612690b1431d27654303e85382bf28
SSDEEP

3072:EPoy8j7VnNdrPHaSekwi+mW+25W1PzoutW:E8jZ7rvaU3+mWr0BzoSW

Score

10^/10

modiloader evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral1/memory/1272-63-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1272-69-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/528-70-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/528-72-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

pid	Process
1272	alper.exe
528	mstwain32.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000005c50-61.dat	upx
behavioral1/files/0x0007000000005c50-59.dat	upx
behavioral1/files/0x0007000000005c50-58.dat	upx
behavioral1/memory/1272-63-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/files/0x0007000000005c50-64.dat	upx
behavioral1/files/0x0007000000005c50-65.dat	upx
behavioral1/files/0x00060000000055d8-67.dat	upx
behavioral1/memory/1272-69-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/528-70-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/528-72-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Loads dropped DLL 3 IoCs

pid	Process
1348	883dd0e1d35a2446e2a2e87b44a79acde65947908dc9ecb1f1f6a5a5d15c0891.exe
1348	883dd0e1d35a2446e2a2e87b44a79acde65947908dc9ecb1f1f6a5a5d15c0891.exe
1272	alper.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	mstwain32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe"	mstwain32.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	alper.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstwain32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\mstwain32.exe	alper.exe
File opened for modification	C:\Windows\mstwain32.exe	alper.exe
File created	C:\Windows\ntdtcstp.dll	mstwain32.exe
File created	C:\Windows\cmsetac.dll	mstwain32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1272	alper.exe
Token: SeBackupPrivilege	1780	vssvc.exe
Token: SeRestorePrivilege	1780	vssvc.exe
Token: SeAuditPrivilege	1780	vssvc.exe
Token: SeDebugPrivilege	528	mstwain32.exe
Token: SeDebugPrivilege	528	mstwain32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1348	883dd0e1d35a2446e2a2e87b44a79acde65947908dc9ecb1f1f6a5a5d15c0891.exe
528	mstwain32.exe
528	mstwain32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1272	1348	883dd0e1d35a2446e2a2e87b44a79acde65947908dc9ecb1f1f6a5a5d15c0891.exe	26
PID 1348 wrote to memory of 1272	1348	883dd0e1d35a2446e2a2e87b44a79acde65947908dc9ecb1f1f6a5a5d15c0891.exe	26
PID 1348 wrote to memory of 1272	1348	883dd0e1d35a2446e2a2e87b44a79acde65947908dc9ecb1f1f6a5a5d15c0891.exe	26
PID 1348 wrote to memory of 1272	1348	883dd0e1d35a2446e2a2e87b44a79acde65947908dc9ecb1f1f6a5a5d15c0891.exe	26
PID 1272 wrote to memory of 528	1272	alper.exe	30
PID 1272 wrote to memory of 528	1272	alper.exe	30
PID 1272 wrote to memory of 528	1272	alper.exe	30
PID 1272 wrote to memory of 528	1272	alper.exe	30

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

C:\Users\Admin\AppData\Local\Temp\883dd0e1d35a2446e2a2e87b44a79acde65947908dc9ecb1f1f6a5a5d15c0891.exe
"C:\Users\Admin\AppData\Local\Temp\883dd0e1d35a2446e2a2e87b44a79acde65947908dc9ecb1f1f6a5a5d15c0891.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Users\Admin\AppData\Local\Temp\alper.exe
  "C:\Users\Admin\AppData\Local\Temp\alper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\mstwain32.exe
    "C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\alper.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:528

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\alper.exe

Filesize
108KB

MD5
220975988aad6880a8c9eeb6681825d0

SHA1
2d75fa49de28fd03ca5ba7574e65276dc52c3115

SHA256
cc17f6c6bc0915d3cea6ca486e25aa781b29de9af0cf33cf2af12872eb1e93ac

SHA512
682f988c260443266db2920d2561d0dc38f516bb862a73967e006f6d9cd0b22a4bb03038f38dd9644d55012f97c1da7d93d20987d680902a78119dad9af70771

Download Submit
C:\Users\Admin\AppData\Local\Temp\alper.exe

Filesize
108KB

MD5
220975988aad6880a8c9eeb6681825d0

SHA1
2d75fa49de28fd03ca5ba7574e65276dc52c3115

SHA256
cc17f6c6bc0915d3cea6ca486e25aa781b29de9af0cf33cf2af12872eb1e93ac

SHA512
682f988c260443266db2920d2561d0dc38f516bb862a73967e006f6d9cd0b22a4bb03038f38dd9644d55012f97c1da7d93d20987d680902a78119dad9af70771

Download Submit
C:\Windows\mstwain32.exe

Filesize
108KB

MD5
220975988aad6880a8c9eeb6681825d0

SHA1
2d75fa49de28fd03ca5ba7574e65276dc52c3115

SHA256
cc17f6c6bc0915d3cea6ca486e25aa781b29de9af0cf33cf2af12872eb1e93ac

SHA512
682f988c260443266db2920d2561d0dc38f516bb862a73967e006f6d9cd0b22a4bb03038f38dd9644d55012f97c1da7d93d20987d680902a78119dad9af70771

Download Submit
\Users\Admin\AppData\Local\Temp\alper.exe

Filesize
108KB

MD5
220975988aad6880a8c9eeb6681825d0

SHA1
2d75fa49de28fd03ca5ba7574e65276dc52c3115

SHA256
cc17f6c6bc0915d3cea6ca486e25aa781b29de9af0cf33cf2af12872eb1e93ac

SHA512
682f988c260443266db2920d2561d0dc38f516bb862a73967e006f6d9cd0b22a4bb03038f38dd9644d55012f97c1da7d93d20987d680902a78119dad9af70771

Download Submit
\Users\Admin\AppData\Local\Temp\alper.exe

Filesize
108KB

MD5
220975988aad6880a8c9eeb6681825d0

SHA1
2d75fa49de28fd03ca5ba7574e65276dc52c3115

SHA256
cc17f6c6bc0915d3cea6ca486e25aa781b29de9af0cf33cf2af12872eb1e93ac

SHA512
682f988c260443266db2920d2561d0dc38f516bb862a73967e006f6d9cd0b22a4bb03038f38dd9644d55012f97c1da7d93d20987d680902a78119dad9af70771

Download Submit
\Users\Admin\AppData\Local\Temp\alper.exe

Filesize
108KB

MD5
220975988aad6880a8c9eeb6681825d0

SHA1
2d75fa49de28fd03ca5ba7574e65276dc52c3115

SHA256
cc17f6c6bc0915d3cea6ca486e25aa781b29de9af0cf33cf2af12872eb1e93ac

SHA512
682f988c260443266db2920d2561d0dc38f516bb862a73967e006f6d9cd0b22a4bb03038f38dd9644d55012f97c1da7d93d20987d680902a78119dad9af70771

Download Submit
memory/528-70-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/528-71-0x0000000002230000-0x000000000223E000-memory.dmp

Filesize
56KB

Download
memory/528-72-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1272-63-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1272-69-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1348-56-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads