modiloader | 6092fa957812ad737266085d5a5ef72952798ecde71acad660455036e1bae872

General

Target

6092fa957812ad737266085d5a5ef72952798ecde71acad660455036e1bae872.exe
Size

136KB
MD5

802f1229eadea45fa845b3c7c099ccc9
SHA1

438e303ef4e161421230977ad3fac84a346e7725
SHA256

6092fa957812ad737266085d5a5ef72952798ecde71acad660455036e1bae872
SHA512

08cac56ff6c8efe28d0a3aeaf41205bd5acf3251639195a9f1f63667be2fb9870e5c7bd44bbc3120a69c3dc5261d2d3b381327226889dd10b67472083bd3221b
SSDEEP

3072:Nioy8j7VnNdrPHaSekwi+mWSanLoTEssout/p:Ny8jZ7rvaU3+mW3LzXoS/

Score

10^/10

modiloader evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

ModiLoader Second Stage 4 IoCs

resource	yara_rule
behavioral1/memory/956-66-0x0000000000400000-0x0000000000451000-memory.dmp	modiloader_stage2
behavioral1/memory/956-72-0x0000000000400000-0x0000000000451000-memory.dmp	modiloader_stage2
behavioral1/memory/988-73-0x0000000000400000-0x0000000000451000-memory.dmp	modiloader_stage2
behavioral1/memory/988-75-0x0000000000400000-0x0000000000451000-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

pid	Process
956	malika.exe
988	mstwain32.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000012744-57.dat	upx
behavioral1/files/0x0007000000012744-58.dat	upx
behavioral1/files/0x0007000000012744-59.dat	upx
behavioral1/files/0x0007000000012744-60.dat	upx
behavioral1/files/0x0007000000012744-62.dat	upx
behavioral1/memory/956-66-0x0000000000400000-0x0000000000451000-memory.dmp	upx
behavioral1/files/0x0007000000012744-67.dat	upx
behavioral1/files/0x0007000000012744-68.dat	upx
behavioral1/files/0x00060000000055df-70.dat	upx
behavioral1/memory/956-72-0x0000000000400000-0x0000000000451000-memory.dmp	upx
behavioral1/memory/988-73-0x0000000000400000-0x0000000000451000-memory.dmp	upx
behavioral1/memory/988-75-0x0000000000400000-0x0000000000451000-memory.dmp	upx

Loads dropped DLL 5 IoCs

pid	Process
1112	6092fa957812ad737266085d5a5ef72952798ecde71acad660455036e1bae872.exe
1112	6092fa957812ad737266085d5a5ef72952798ecde71acad660455036e1bae872.exe
1112	6092fa957812ad737266085d5a5ef72952798ecde71acad660455036e1bae872.exe
1112	6092fa957812ad737266085d5a5ef72952798ecde71acad660455036e1bae872.exe
956	malika.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe"	mstwain32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	mstwain32.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	malika.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstwain32.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\ntdtcstp.dll	mstwain32.exe
File created	C:\Windows\cmsetac.dll	mstwain32.exe
File created	C:\Windows\mstwain32.exe	malika.exe
File opened for modification	C:\Windows\mstwain32.exe	malika.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	malika.exe
Token: SeBackupPrivilege	2036	vssvc.exe
Token: SeRestorePrivilege	2036	vssvc.exe
Token: SeAuditPrivilege	2036	vssvc.exe
Token: SeDebugPrivilege	988	mstwain32.exe
Token: SeDebugPrivilege	988	mstwain32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1112	6092fa957812ad737266085d5a5ef72952798ecde71acad660455036e1bae872.exe
988	mstwain32.exe
988	mstwain32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 956	1112	6092fa957812ad737266085d5a5ef72952798ecde71acad660455036e1bae872.exe	28
PID 1112 wrote to memory of 956	1112	6092fa957812ad737266085d5a5ef72952798ecde71acad660455036e1bae872.exe	28
PID 1112 wrote to memory of 956	1112	6092fa957812ad737266085d5a5ef72952798ecde71acad660455036e1bae872.exe	28
PID 1112 wrote to memory of 956	1112	6092fa957812ad737266085d5a5ef72952798ecde71acad660455036e1bae872.exe	28
PID 956 wrote to memory of 988	956	malika.exe	32
PID 956 wrote to memory of 988	956	malika.exe	32
PID 956 wrote to memory of 988	956	malika.exe	32
PID 956 wrote to memory of 988	956	malika.exe	32

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

C:\Users\Admin\AppData\Local\Temp\6092fa957812ad737266085d5a5ef72952798ecde71acad660455036e1bae872.exe
"C:\Users\Admin\AppData\Local\Temp\6092fa957812ad737266085d5a5ef72952798ecde71acad660455036e1bae872.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Users\Admin\AppData\Local\Temp\malika.exe
  "C:\Users\Admin\AppData\Local\Temp\malika.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\mstwain32.exe
    "C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\malika.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:988

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\malika.exe

Filesize
110KB

MD5
90f2dd65f7845ff9298d6975a15bb796

SHA1
9e11bcd923238616483174721e03d1fc73e25720

SHA256
3d0405c597189bbece3d27afd45c1191c693d91c633d2e2bfe10158a97cd41db

SHA512
8571b030fadd3bb6da7be7958e0f22532fe8fe793d76341f7bb40dd1fe4092512ce2b026808cf99e60d2b66280e3aa73b774bc840059ba5084856216a0fba1ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\malika.exe

Filesize
110KB

MD5
90f2dd65f7845ff9298d6975a15bb796

SHA1
9e11bcd923238616483174721e03d1fc73e25720

SHA256
3d0405c597189bbece3d27afd45c1191c693d91c633d2e2bfe10158a97cd41db

SHA512
8571b030fadd3bb6da7be7958e0f22532fe8fe793d76341f7bb40dd1fe4092512ce2b026808cf99e60d2b66280e3aa73b774bc840059ba5084856216a0fba1ed

Download Submit
C:\Windows\mstwain32.exe

Filesize
110KB

MD5
90f2dd65f7845ff9298d6975a15bb796

SHA1
9e11bcd923238616483174721e03d1fc73e25720

SHA256
3d0405c597189bbece3d27afd45c1191c693d91c633d2e2bfe10158a97cd41db

SHA512
8571b030fadd3bb6da7be7958e0f22532fe8fe793d76341f7bb40dd1fe4092512ce2b026808cf99e60d2b66280e3aa73b774bc840059ba5084856216a0fba1ed

Download Submit
\Users\Admin\AppData\Local\Temp\malika.exe

Filesize
110KB

MD5
90f2dd65f7845ff9298d6975a15bb796

SHA1
9e11bcd923238616483174721e03d1fc73e25720

SHA256
3d0405c597189bbece3d27afd45c1191c693d91c633d2e2bfe10158a97cd41db

SHA512
8571b030fadd3bb6da7be7958e0f22532fe8fe793d76341f7bb40dd1fe4092512ce2b026808cf99e60d2b66280e3aa73b774bc840059ba5084856216a0fba1ed

Download Submit
\Users\Admin\AppData\Local\Temp\malika.exe

Filesize
110KB

MD5
90f2dd65f7845ff9298d6975a15bb796

SHA1
9e11bcd923238616483174721e03d1fc73e25720

SHA256
3d0405c597189bbece3d27afd45c1191c693d91c633d2e2bfe10158a97cd41db

SHA512
8571b030fadd3bb6da7be7958e0f22532fe8fe793d76341f7bb40dd1fe4092512ce2b026808cf99e60d2b66280e3aa73b774bc840059ba5084856216a0fba1ed

Download Submit
\Users\Admin\AppData\Local\Temp\malika.exe

Filesize
110KB

MD5
90f2dd65f7845ff9298d6975a15bb796

SHA1
9e11bcd923238616483174721e03d1fc73e25720

SHA256
3d0405c597189bbece3d27afd45c1191c693d91c633d2e2bfe10158a97cd41db

SHA512
8571b030fadd3bb6da7be7958e0f22532fe8fe793d76341f7bb40dd1fe4092512ce2b026808cf99e60d2b66280e3aa73b774bc840059ba5084856216a0fba1ed

Download Submit
\Users\Admin\AppData\Local\Temp\malika.exe

Filesize
110KB

MD5
90f2dd65f7845ff9298d6975a15bb796

SHA1
9e11bcd923238616483174721e03d1fc73e25720

SHA256
3d0405c597189bbece3d27afd45c1191c693d91c633d2e2bfe10158a97cd41db

SHA512
8571b030fadd3bb6da7be7958e0f22532fe8fe793d76341f7bb40dd1fe4092512ce2b026808cf99e60d2b66280e3aa73b774bc840059ba5084856216a0fba1ed

Download Submit
\Users\Admin\AppData\Local\Temp\malika.exe

Filesize
110KB

MD5
90f2dd65f7845ff9298d6975a15bb796

SHA1
9e11bcd923238616483174721e03d1fc73e25720

SHA256
3d0405c597189bbece3d27afd45c1191c693d91c633d2e2bfe10158a97cd41db

SHA512
8571b030fadd3bb6da7be7958e0f22532fe8fe793d76341f7bb40dd1fe4092512ce2b026808cf99e60d2b66280e3aa73b774bc840059ba5084856216a0fba1ed

Download Submit
memory/956-72-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/956-66-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/988-73-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/988-74-0x0000000000350000-0x000000000035E000-memory.dmp

Filesize
56KB

Download
memory/988-75-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1112-56-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1112-64-0x0000000004A60000-0x0000000004AB1000-memory.dmp

Filesize
324KB

Download
memory/1112-65-0x0000000004A60000-0x0000000004AB1000-memory.dmp

Filesize
324KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads