modiloader | 86d44d3c698ae072cbe4678e12606721f1904d77fa7f229d0774e855a78bc75f

General

Target

86d44d3c698ae072cbe4678e12606721f1904d77fa7f229d0774e855a78bc75f.exe
Size

666KB
MD5

5187b4936b4b4880a3859729b5edc537
SHA1

43cba6c2e662ee5bb8a63a3fa1e73d3cb0a465a8
SHA256

86d44d3c698ae072cbe4678e12606721f1904d77fa7f229d0774e855a78bc75f
SHA512

e08c0d98fc443704cbe89e15da2a3322ccd009abbbabf4580dd1ed98afc1287bf12064a64f9abd061e8957984a94e7d6cfb45d933b1610a6931aed2fe6e4c805
SSDEEP

12288:aHLUMuiv9RgfSjAzRtyK+7PiJNMwEqCf6lxwfMUVQSHYcu9c00E5zZSK:4tARyCtDwfRQCY1qej

Score

10^/10

modiloader evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

mstwain32.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

ModiLoader Second Stage 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\küüüüüüüüüü.exe	modiloader_stage2
C:\Users\Admin\AppData\Local\Temp\küüüüüüüüüü.exe	modiloader_stage2
C:\Windows\mstwain32.exe	modiloader_stage2
C:\Windows\mstwain32.exe	modiloader_stage2

Executes dropped EXE 2 IoCs

Processes:

küüüüüüüüüü.exemstwain32.exe

pid process

964 küüüüüüüüüü.exe
2456 mstwain32.exe

pid	process
964	küüüüüüüüüü.exe
2456	mstwain32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4504-132-0x0000000000400000-0x00000000004AC000-memory.dmp	upx
behavioral2/memory/4504-136-0x0000000000400000-0x00000000004AC000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

küüüüüüüüüü.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	küüüüüüüüüü.exe

Loads dropped DLL 4 IoCs

Processes:

mstwain32.exe

pid process

2456 mstwain32.exe
2456 mstwain32.exe
2456 mstwain32.exe
2456 mstwain32.exe

pid	process
2456	mstwain32.exe
2456	mstwain32.exe
2456	mstwain32.exe
2456	mstwain32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

mstwain32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	mstwain32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe"	mstwain32.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

mstwain32.exeküüüüüüüüüü.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstwain32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	küüüüüüüüüü.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/4504-132-0x0000000000400000-0x00000000004AC000-memory.dmp	autoit_exe
behavioral2/memory/4504-136-0x0000000000400000-0x00000000004AC000-memory.dmp	autoit_exe

Drops file in Windows directory 4 IoCs

Processes:

mstwain32.exeküüüüüüüüüü.exe

description	ioc	process
File created	C:\Windows\cmsetac.dll	mstwain32.exe
File created	C:\Windows\mstwain32.exe	küüüüüüüüüü.exe
File opened for modification	C:\Windows\mstwain32.exe	küüüüüüüüüü.exe
File created	C:\Windows\ntdtcstp.dll	mstwain32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

küüüüüüüüüü.exevssvc.exemstwain32.exe

description	pid	process
Token: SeDebugPrivilege	964	küüüüüüüüüü.exe
Token: SeBackupPrivilege	2268	vssvc.exe
Token: SeRestorePrivilege	2268	vssvc.exe
Token: SeAuditPrivilege	2268	vssvc.exe
Token: SeDebugPrivilege	2456	mstwain32.exe
Token: SeDebugPrivilege	2456	mstwain32.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

86d44d3c698ae072cbe4678e12606721f1904d77fa7f229d0774e855a78bc75f.exeküüüüüüüüüü.exe

pid	process
4504	86d44d3c698ae072cbe4678e12606721f1904d77fa7f229d0774e855a78bc75f.exe
4504	86d44d3c698ae072cbe4678e12606721f1904d77fa7f229d0774e855a78bc75f.exe
4504	86d44d3c698ae072cbe4678e12606721f1904d77fa7f229d0774e855a78bc75f.exe
964	küüüüüüüüüü.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

86d44d3c698ae072cbe4678e12606721f1904d77fa7f229d0774e855a78bc75f.exe

pid	process
4504	86d44d3c698ae072cbe4678e12606721f1904d77fa7f229d0774e855a78bc75f.exe
4504	86d44d3c698ae072cbe4678e12606721f1904d77fa7f229d0774e855a78bc75f.exe
4504	86d44d3c698ae072cbe4678e12606721f1904d77fa7f229d0774e855a78bc75f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

mstwain32.exe

pid process

2456 mstwain32.exe
2456 mstwain32.exe

pid	process
2456	mstwain32.exe
2456	mstwain32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

86d44d3c698ae072cbe4678e12606721f1904d77fa7f229d0774e855a78bc75f.exeküüüüüüüüüü.exe

description	pid	process	target process
PID 4504 wrote to memory of 964	4504	86d44d3c698ae072cbe4678e12606721f1904d77fa7f229d0774e855a78bc75f.exe	küüüüüüüüüü.exe
PID 4504 wrote to memory of 964	4504	86d44d3c698ae072cbe4678e12606721f1904d77fa7f229d0774e855a78bc75f.exe	küüüüüüüüüü.exe
PID 4504 wrote to memory of 964	4504	86d44d3c698ae072cbe4678e12606721f1904d77fa7f229d0774e855a78bc75f.exe	küüüüüüüüüü.exe
PID 964 wrote to memory of 2456	964	küüüüüüüüüü.exe	mstwain32.exe
PID 964 wrote to memory of 2456	964	küüüüüüüüüü.exe	mstwain32.exe
PID 964 wrote to memory of 2456	964	küüüüüüüüüü.exe	mstwain32.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

mstwain32.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

C:\Users\Admin\AppData\Local\Temp\86d44d3c698ae072cbe4678e12606721f1904d77fa7f229d0774e855a78bc75f.exe
"C:\Users\Admin\AppData\Local\Temp\86d44d3c698ae072cbe4678e12606721f1904d77fa7f229d0774e855a78bc75f.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4504

C:\Users\Admin\AppData\Local\Temp\küüüüüüüüüü.exe
C:\Users\Admin\AppData\Local\Temp/küüüüüüüüüü.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\mstwain32.exe
"C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\küüüüüüüüüü.exe"
3⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2456

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\küüüüüüüüüü.exe
Filesize
497KB

MD5
11ac163549fa998cae43205060cec17d

SHA1
97d8683f731107ef15ef465c47a01ae5320226db

SHA256
6ca003ef95455766a26fd88dc6734ca3ebb4c79a130c3a12de012b5672e80205

SHA512
483ef92aee2cc8838f8dbd050e7874299da44e02925491ead7da834344a5443ed5d5a9c9da7e3bbabb8e6de7e6c988d85d9623e9af6d2d8a9de8174b70aee29c

Download Submit
C:\Users\Admin\AppData\Local\Temp\küüüüüüüüüü.exe
Filesize
497KB

MD5
11ac163549fa998cae43205060cec17d

SHA1
97d8683f731107ef15ef465c47a01ae5320226db

SHA256
6ca003ef95455766a26fd88dc6734ca3ebb4c79a130c3a12de012b5672e80205

SHA512
483ef92aee2cc8838f8dbd050e7874299da44e02925491ead7da834344a5443ed5d5a9c9da7e3bbabb8e6de7e6c988d85d9623e9af6d2d8a9de8174b70aee29c

Download Submit
C:\Windows\cmsetac.dll
Filesize
32KB

MD5
83edeb54a36a3d1208293d43ca891a4d

SHA1
4ed8f5e48907ef1c9dff3db055caa2a691ca844b

SHA256
1f84e81a6a9ccb4a3e43b465aeaaea5533f48530ec5ddb2fa217af7c075e15b5

SHA512
1418b16bffbb6a6edc3de6801d4eeaa517356fb511126dee49539f443ba915b6203582344678ee464eed6c44e9ab45c9fa234f4a167f76e2d2b2e20c8b807c1a

Download Submit
C:\Windows\cmsetac.dll
Filesize
32KB

MD5
83edeb54a36a3d1208293d43ca891a4d

SHA1
4ed8f5e48907ef1c9dff3db055caa2a691ca844b

SHA256
1f84e81a6a9ccb4a3e43b465aeaaea5533f48530ec5ddb2fa217af7c075e15b5

SHA512
1418b16bffbb6a6edc3de6801d4eeaa517356fb511126dee49539f443ba915b6203582344678ee464eed6c44e9ab45c9fa234f4a167f76e2d2b2e20c8b807c1a

Download Submit
C:\Windows\mstwain32.exe
Filesize
497KB

MD5
11ac163549fa998cae43205060cec17d

SHA1
97d8683f731107ef15ef465c47a01ae5320226db

SHA256
6ca003ef95455766a26fd88dc6734ca3ebb4c79a130c3a12de012b5672e80205

SHA512
483ef92aee2cc8838f8dbd050e7874299da44e02925491ead7da834344a5443ed5d5a9c9da7e3bbabb8e6de7e6c988d85d9623e9af6d2d8a9de8174b70aee29c

Download Submit
C:\Windows\mstwain32.exe
Filesize
497KB

MD5
11ac163549fa998cae43205060cec17d

SHA1
97d8683f731107ef15ef465c47a01ae5320226db

SHA256
6ca003ef95455766a26fd88dc6734ca3ebb4c79a130c3a12de012b5672e80205

SHA512
483ef92aee2cc8838f8dbd050e7874299da44e02925491ead7da834344a5443ed5d5a9c9da7e3bbabb8e6de7e6c988d85d9623e9af6d2d8a9de8174b70aee29c

Download Submit
C:\Windows\ntdtcstp.dll
Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
C:\Windows\ntdtcstp.dll
Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
memory/964-133-0x0000000000000000-mapping.dmp

Download
memory/2456-137-0x0000000000000000-mapping.dmp

Download
memory/2456-144-0x0000000002340000-0x000000000234E000-memory.dmp

Filesize
56KB

Download
memory/4504-132-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/4504-136-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads