modiloader | 999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365

General

Target

999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365.exe
Size

114KB
MD5

b0f87b7b823be4cf0f00d87cfaa45e9c
SHA1

499d5b6beab4871b2b21a2d3b2a88e89eb42fb41
SHA256

999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365
SHA512

d63c3f6ac3498b736c27df2cbad3dcb8d5607029e3177cd87037a23fbfff613c09c3a1ad3ef60a31c892a9279d62457e27e026b832d75cca97935e4d6966a0fd
SSDEEP

1536:zVuNAXTj4Fj/91/NnLZqeWEPVpa8DzePjkgcwYS7S5+Vfk09H9Tkr8y+Oenouy8:xoy8j7VnNdrPHaSekwi+mWH+kout

Score

10^/10

modiloader evasion trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365.exe

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/560-56-0x0000000000400000-0x0000000000451000-memory.dmp	modiloader_stage2

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/560-54-0x0000000000400000-0x0000000000451000-memory.dmp	upx
behavioral1/memory/560-56-0x0000000000400000-0x0000000000451000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365.exe

pid	process
560	999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365.exe
560	999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	560	999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365.exe
Token: SeBackupPrivilege	1744	vssvc.exe
Token: SeRestorePrivilege	1744	vssvc.exe
Token: SeAuditPrivilege	1744	vssvc.exe
Token: SeDebugPrivilege	560	999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365.exe

pid	process
560	999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365.exe
560	999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365.exe

C:\Users\Admin\AppData\Local\Temp\999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365.exe
"C:\Users\Admin\AppData\Local\Temp\999585aea4c06c220812c2fd3a42426a528448f1ab1273de7d27593bcea5b365.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:560

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1744

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\cmsetac.dll
Filesize
33KB

MD5
6276602893f2fe8694a4351595757187

SHA1
fa597ff9da1b205f6f2f76ef08c53b7ebc33e364

SHA256
07808f587103261a323f2abec56174511efcc0dba3bcdf4bf5c32f9060d96276

SHA512
2a80a437d1c2f9df1bcf2802e76839c52cfaefda65fed503b7814afef1f696e94b5f63fdfe8fdba8641e9d4ea1de77bebef2910206eacb5886f2147eb76c8f68

Download Submit
\Users\Admin\AppData\Local\Temp\ntdtcstp.dll
Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
memory/560-54-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/560-55-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/560-56-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/560-59-0x0000000000580000-0x000000000058E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads