modiloader | b992c0a62a337a37011163613cba9c0670db8ecb113e30b0a92b01cdafbdc6b5

Analysis

max time kernel
144s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 09:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b992c0a62a337a37011163613cba9c0670db8ecb113e30b0a92b01cdafbdc6b5.exe
Size

112KB
MD5

51c4c94b1aeafef95445039f10efc98e
SHA1

2d095549f23578fc2d8130a48cba5a849aa06cfa
SHA256

b992c0a62a337a37011163613cba9c0670db8ecb113e30b0a92b01cdafbdc6b5
SHA512

4a5efe751f331d27cf24646ce70c4a7495fe77ae18db5f07857aa45288e0060358ef41b2656635901d1a94a1c807e2bf640121cdb8ea40998fb3c9de7ecc7197
SSDEEP

3072:hoy8j7VnNdrPHaSekwi+mWjldEnsBJ5+out:x8jZ7rvaU3+mWrEsj5+oS

Score

10^/10

modiloader evasion trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b992c0a62a337a37011163613cba9c0670db8ecb113e30b0a92b01cdafbdc6b5.exe

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/memory/1900-134-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/1900-138-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1900-134-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1900-138-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Loads dropped DLL 4 IoCs

pid	Process
1900	b992c0a62a337a37011163613cba9c0670db8ecb113e30b0a92b01cdafbdc6b5.exe
1900	b992c0a62a337a37011163613cba9c0670db8ecb113e30b0a92b01cdafbdc6b5.exe
1900	b992c0a62a337a37011163613cba9c0670db8ecb113e30b0a92b01cdafbdc6b5.exe
1900	b992c0a62a337a37011163613cba9c0670db8ecb113e30b0a92b01cdafbdc6b5.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b992c0a62a337a37011163613cba9c0670db8ecb113e30b0a92b01cdafbdc6b5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b992c0a62a337a37011163613cba9c0670db8ecb113e30b0a92b01cdafbdc6b5.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	b992c0a62a337a37011163613cba9c0670db8ecb113e30b0a92b01cdafbdc6b5.exe
Token: SeDebugPrivilege	1900	b992c0a62a337a37011163613cba9c0670db8ecb113e30b0a92b01cdafbdc6b5.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1900	b992c0a62a337a37011163613cba9c0670db8ecb113e30b0a92b01cdafbdc6b5.exe
1900	b992c0a62a337a37011163613cba9c0670db8ecb113e30b0a92b01cdafbdc6b5.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b992c0a62a337a37011163613cba9c0670db8ecb113e30b0a92b01cdafbdc6b5.exe

C:\Users\Admin\AppData\Local\Temp\b992c0a62a337a37011163613cba9c0670db8ecb113e30b0a92b01cdafbdc6b5.exe
"C:\Users\Admin\AppData\Local\Temp\b992c0a62a337a37011163613cba9c0670db8ecb113e30b0a92b01cdafbdc6b5.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cmsetac.dll

Filesize
33KB

MD5
863810a802c6091968889bf8c6dc614d

SHA1
921d78ee6531730318c11cf80b1b4204843fe75a

SHA256
7f7b92fcfeef601debf2c818e12c063058fe6bf9467aea2438234895003cc77d

SHA512
38390ffddd2933793ef8b6a5423fdbcdda99a941d70f76dbe1ffd38976ff23bacf4498c2ceff29a950fb55d366345f6ef41c449c5287a5c5bef9ac2c911e6e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\cmsetac.dll

Filesize
33KB

MD5
863810a802c6091968889bf8c6dc614d

SHA1
921d78ee6531730318c11cf80b1b4204843fe75a

SHA256
7f7b92fcfeef601debf2c818e12c063058fe6bf9467aea2438234895003cc77d

SHA512
38390ffddd2933793ef8b6a5423fdbcdda99a941d70f76dbe1ffd38976ff23bacf4498c2ceff29a950fb55d366345f6ef41c449c5287a5c5bef9ac2c911e6e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ntdtcstp.dll

Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
C:\Users\Admin\AppData\Local\Temp\ntdtcstp.dll

Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
memory/1900-134-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1900-137-0x0000000002330000-0x000000000233E000-memory.dmp

Filesize
56KB

Download
memory/1900-138-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads