modiloader | d69fa812e0f838aed138fd42c00d23d531a70710687f36cbd954bdec77d4faf8

General

Target

d69fa812e0f838aed138fd42c00d23d531a70710687f36cbd954bdec77d4faf8.exe
Size

414KB
MD5

69c640721d56e29dde88a6015ee316ad
SHA1

d2ac02e3dec5a5d54ef59ddada7c42aa4acbe411
SHA256

d69fa812e0f838aed138fd42c00d23d531a70710687f36cbd954bdec77d4faf8
SHA512

6a78c4d04012a421832e8bd85fc071736a48be54e8b2bbff36642838da854d5c30053dc30f42f11ec75c72e15a1ec17c3f9eae8749ac9b0089c839be7d8da957
SSDEEP

6144:IKrxiyLvmWVXGlbA24ZjUPcajcUAOmhKo6iYK32FLUSdlFh6w4/nIVgcHw:VtLXh+owPcajlmh11M3ZUw4/DcQ

Score

10^/10

modiloader discovery evasion persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral2/files/0x0004000000022dca-133.dat	modiloader_stage2
behavioral2/files/0x0004000000022dca-134.dat	modiloader_stage2
behavioral2/files/0x000500000001e472-136.dat	modiloader_stage2
behavioral2/files/0x000500000001e472-137.dat	modiloader_stage2

Executes dropped EXE 2 IoCs

pid	Process
2200	server.exe
4920	mstwain32.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	d69fa812e0f838aed138fd42c00d23d531a70710687f36cbd954bdec77d4faf8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	server.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\server.exe	d69fa812e0f838aed138fd42c00d23d531a70710687f36cbd954bdec77d4faf8.exe

Loads dropped DLL 4 IoCs

pid	Process
4920	mstwain32.exe
4920	mstwain32.exe
4920	mstwain32.exe
4920	mstwain32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	mstwain32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe"	mstwain32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	server.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstwain32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	d69fa812e0f838aed138fd42c00d23d531a70710687f36cbd954bdec77d4faf8.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	d69fa812e0f838aed138fd42c00d23d531a70710687f36cbd954bdec77d4faf8.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\mstwain32.exe	server.exe
File opened for modification	C:\Windows\mstwain32.exe	server.exe
File created	C:\Windows\ntdtcstp.dll	mstwain32.exe
File created	C:\Windows\cmsetac.dll	mstwain32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	server.exe
Token: SeBackupPrivilege	2460	vssvc.exe
Token: SeRestorePrivilege	2460	vssvc.exe
Token: SeAuditPrivilege	2460	vssvc.exe
Token: SeDebugPrivilege	4920	mstwain32.exe
Token: SeDebugPrivilege	4920	mstwain32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4920	mstwain32.exe
4920	mstwain32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 2200	4616	d69fa812e0f838aed138fd42c00d23d531a70710687f36cbd954bdec77d4faf8.exe	83
PID 4616 wrote to memory of 2200	4616	d69fa812e0f838aed138fd42c00d23d531a70710687f36cbd954bdec77d4faf8.exe	83
PID 4616 wrote to memory of 2200	4616	d69fa812e0f838aed138fd42c00d23d531a70710687f36cbd954bdec77d4faf8.exe	83
PID 2200 wrote to memory of 4920	2200	server.exe	90
PID 2200 wrote to memory of 4920	2200	server.exe	90
PID 2200 wrote to memory of 4920	2200	server.exe	90

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

C:\Users\Admin\AppData\Local\Temp\d69fa812e0f838aed138fd42c00d23d531a70710687f36cbd954bdec77d4faf8.exe
"C:\Users\Admin\AppData\Local\Temp\d69fa812e0f838aed138fd42c00d23d531a70710687f36cbd954bdec77d4faf8.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\server.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\server.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\mstwain32.exe
    "C:\Windows\mstwain32.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:4920

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\server.exe

Filesize
270KB

MD5
8b6c9f098b0a4d99ddf2b62fb6f93878

SHA1
4ae585cdbba74df272d602c3a7e23c5e425ceb6d

SHA256
acff69472697cb2a32a6b9fe6b6e7dfc2f28cd8785ea028982a60f799ac3a41a

SHA512
7a4ac40edf0167d609ab57da2327bdc49f2b9349f98bc47c12bcae1b18ba190997e2a452662ae891a1263a0da7bed27ddefbb99559f699380f85c94b2212b6c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\server.exe

Filesize
270KB

MD5
8b6c9f098b0a4d99ddf2b62fb6f93878

SHA1
4ae585cdbba74df272d602c3a7e23c5e425ceb6d

SHA256
acff69472697cb2a32a6b9fe6b6e7dfc2f28cd8785ea028982a60f799ac3a41a

SHA512
7a4ac40edf0167d609ab57da2327bdc49f2b9349f98bc47c12bcae1b18ba190997e2a452662ae891a1263a0da7bed27ddefbb99559f699380f85c94b2212b6c3

Download Submit
C:\Windows\cmsetac.dll

Filesize
33KB

MD5
dc1555bc443fb6305492848c78635f1d

SHA1
89dd82aec9ee41ce743da9cbc7ee6e754007c316

SHA256
5793600ab91c5f60d2389af478c846672171598763bfbff3a4e636aba7658b03

SHA512
bc3cd050314d58253b62432a86af0e3451c6a302f715ad7d72acaac203d07b149bc9452a658ae33231ae10ff0361d6f52c25fc2fb420891aae3f2b5309785829

Download Submit
C:\Windows\cmsetac.dll

Filesize
33KB

MD5
dc1555bc443fb6305492848c78635f1d

SHA1
89dd82aec9ee41ce743da9cbc7ee6e754007c316

SHA256
5793600ab91c5f60d2389af478c846672171598763bfbff3a4e636aba7658b03

SHA512
bc3cd050314d58253b62432a86af0e3451c6a302f715ad7d72acaac203d07b149bc9452a658ae33231ae10ff0361d6f52c25fc2fb420891aae3f2b5309785829

Download Submit
C:\Windows\mstwain32.exe

Filesize
270KB

MD5
8b6c9f098b0a4d99ddf2b62fb6f93878

SHA1
4ae585cdbba74df272d602c3a7e23c5e425ceb6d

SHA256
acff69472697cb2a32a6b9fe6b6e7dfc2f28cd8785ea028982a60f799ac3a41a

SHA512
7a4ac40edf0167d609ab57da2327bdc49f2b9349f98bc47c12bcae1b18ba190997e2a452662ae891a1263a0da7bed27ddefbb99559f699380f85c94b2212b6c3

Download Submit
C:\Windows\mstwain32.exe

Filesize
270KB

MD5
8b6c9f098b0a4d99ddf2b62fb6f93878

SHA1
4ae585cdbba74df272d602c3a7e23c5e425ceb6d

SHA256
acff69472697cb2a32a6b9fe6b6e7dfc2f28cd8785ea028982a60f799ac3a41a

SHA512
7a4ac40edf0167d609ab57da2327bdc49f2b9349f98bc47c12bcae1b18ba190997e2a452662ae891a1263a0da7bed27ddefbb99559f699380f85c94b2212b6c3

Download Submit
C:\Windows\ntdtcstp.dll

Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
C:\Windows\ntdtcstp.dll

Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
memory/4920-142-0x0000000002200000-0x000000000220E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads