modiloader | 2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097

General

Target

2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe
Size

108KB
MD5

537316f23cf07bdde46b86413229bebc
SHA1

17130f204141e5add79cfe6e628ff2c2012aaa7d
SHA256

2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097
SHA512

baf306dd5d73d7e69bfe22d45939ee20959340675e023c4150595547dbbcb94e9c517181a50b7d252ce5c67750a571182c536e1ecb19136fcfa44566b2795678
SSDEEP

3072:koy8j7VnNdrPHaSekwi+mW+2AMTQ6WW44Fout:U8jZ7rvaU3+mWrXM61xFoS

Score

10^/10

modiloader evasion trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3916-138-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3916-132-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/3916-138-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Loads dropped DLL 4 IoCs

Processes:

2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe

pid	process
3916	2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe
3916	2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe
3916	2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe
3916	2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe

description	pid	process
Token: SeDebugPrivilege	3916	2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe
Token: SeDebugPrivilege	3916	2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe

pid	process
3916	2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe
3916	2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe

C:\Users\Admin\AppData\Local\Temp\2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe
"C:\Users\Admin\AppData\Local\Temp\2717b8b6a7ce1637c1ed3467ce3f6e3cfa321ca26e743fb5596cde7f8e403097.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cmsetac.dll
Filesize
33KB

MD5
a7a9d1fae63a2f861c042e09b93ad5ab

SHA1
ca442670b1f5609d6e387197056f6fc07d126c34

SHA256
0a965d06baa117b825c102c6b86a02bd729c23ad8dd75eb94853c20dc936357a

SHA512
e5088f4d4838ac7cd7679ff2c53c943fdf7935c63caa18e0bc7c5319bfb6dcb3c4125a229ef9f285a238041ee89a1164cb5435f32b292937bcd55eef277ca83c

Download Submit
C:\Users\Admin\AppData\Local\Temp\cmsetac.dll
Filesize
33KB

MD5
a7a9d1fae63a2f861c042e09b93ad5ab

SHA1
ca442670b1f5609d6e387197056f6fc07d126c34

SHA256
0a965d06baa117b825c102c6b86a02bd729c23ad8dd75eb94853c20dc936357a

SHA512
e5088f4d4838ac7cd7679ff2c53c943fdf7935c63caa18e0bc7c5319bfb6dcb3c4125a229ef9f285a238041ee89a1164cb5435f32b292937bcd55eef277ca83c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ntdtcstp.dll
Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
C:\Users\Admin\AppData\Local\Temp\ntdtcstp.dll
Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
memory/3916-132-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3916-137-0x00000000031C0000-0x00000000031CE000-memory.dmp

Filesize
56KB

Download
memory/3916-138-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads