modiloader | f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4

General

Target

f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe
Size

136KB
MD5

86857643e3a2d4f5823491d5ab1acbe5
SHA1

a8be9490a9f3d81f36fe949e5d8b91260ae84884
SHA256

f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4
SHA512

1bfd90e53c580ee8c873b0fa4063a05d376910a62542ecea88f64798185c3cf294a9852c99dfb5e6010e656c4dcc189b4809a92ba4ab95ad3a1b82a78be8c427
SSDEEP

3072:2rq+a1DSSiZdlJYoECbso4mZW6frwnEv:Sa0LvXuCgo/RTw

Score

10^/10

modiloader evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

Victima.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Victima.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Victima.exe

ModiLoader Second Stage 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2248-138-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral2/memory/2248-139-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral2/memory/2248-140-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral2/memory/2248-144-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral2/memory/3508-152-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral2/memory/3508-158-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral2/memory/3508-159-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

Processes:

Victima.exeVictima.exe

pid process

4496 Victima.exe
3508 Victima.exe

pid	process
4496	Victima.exe
3508	Victima.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2248-135-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/2248-137-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/2248-138-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/2248-139-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/2248-140-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/2248-144-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/3508-151-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/3508-152-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/3508-158-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/3508-159-0x0000000000400000-0x000000000044F000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe

Loads dropped DLL 4 IoCs

Processes:

Victima.exe

pid process

3508 Victima.exe
3508 Victima.exe
3508 Victima.exe
3508 Victima.exe

pid	process
3508	Victima.exe
3508	Victima.exe
3508	Victima.exe
3508	Victima.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Victima.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	Victima.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Victima = "C:\\Windows\\Victima.exe"	Victima.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exeVictima.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Victima.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Victima.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exeVictima.exe

description	pid	process	target process
PID 4408 set thread context of 2248	4408	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe
PID 4496 set thread context of 3508	4496	Victima.exe	Victima.exe

Drops file in Windows directory 5 IoCs

Processes:

f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exeVictima.exeVictima.exe

description	ioc	process
File created	C:\Windows\Victima.exe	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe
File opened for modification	C:\Windows\Victima.exe	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe
File opened for modification	C:\Windows\Victima.exe	Victima.exe
File created	C:\Windows\ntdtcstp.dll	Victima.exe
File created	C:\Windows\cmsetac.dll	Victima.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exevssvc.exeVictima.exe

description	pid	process
Token: SeDebugPrivilege	2248	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe
Token: SeBackupPrivilege	4852	vssvc.exe
Token: SeRestorePrivilege	4852	vssvc.exe
Token: SeAuditPrivilege	4852	vssvc.exe
Token: SeDebugPrivilege	3508	Victima.exe
Token: SeDebugPrivilege	3508	Victima.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exeVictima.exeVictima.exe

pid process

4408 f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe
4496 Victima.exe
3508 Victima.exe
3508 Victima.exe

pid	process
4408	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe
4496	Victima.exe
3508	Victima.exe
3508	Victima.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exef0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exeVictima.exe

description	pid	process	target process
PID 4408 wrote to memory of 2248	4408	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe
PID 4408 wrote to memory of 2248	4408	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe
PID 4408 wrote to memory of 2248	4408	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe
PID 4408 wrote to memory of 2248	4408	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe
PID 4408 wrote to memory of 2248	4408	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe
PID 4408 wrote to memory of 2248	4408	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe
PID 4408 wrote to memory of 2248	4408	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe
PID 4408 wrote to memory of 2248	4408	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe
PID 2248 wrote to memory of 4496	2248	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe	Victima.exe
PID 2248 wrote to memory of 4496	2248	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe	Victima.exe
PID 2248 wrote to memory of 4496	2248	f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe	Victima.exe
PID 4496 wrote to memory of 3508	4496	Victima.exe	Victima.exe
PID 4496 wrote to memory of 3508	4496	Victima.exe	Victima.exe
PID 4496 wrote to memory of 3508	4496	Victima.exe	Victima.exe
PID 4496 wrote to memory of 3508	4496	Victima.exe	Victima.exe
PID 4496 wrote to memory of 3508	4496	Victima.exe	Victima.exe
PID 4496 wrote to memory of 3508	4496	Victima.exe	Victima.exe
PID 4496 wrote to memory of 3508	4496	Victima.exe	Victima.exe
PID 4496 wrote to memory of 3508	4496	Victima.exe	Victima.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

Victima.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Victima.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Victima.exe

C:\Users\Admin\AppData\Local\Temp\f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe
"C:\Users\Admin\AppData\Local\Temp\f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4408

C:\Users\Admin\AppData\Local\Temp\f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe
C:\Users\Admin\AppData\Local\Temp\f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe
2⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248

C:\Windows\Victima.exe
"C:\Windows\Victima.exe" \melt "C:\Users\Admin\AppData\Local\Temp\f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496

C:\Windows\Victima.exe
C:\Windows\Victima.exe
4⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3508

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4852

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Victima.exe
Filesize
136KB

MD5
86857643e3a2d4f5823491d5ab1acbe5

SHA1
a8be9490a9f3d81f36fe949e5d8b91260ae84884

SHA256
f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4

SHA512
1bfd90e53c580ee8c873b0fa4063a05d376910a62542ecea88f64798185c3cf294a9852c99dfb5e6010e656c4dcc189b4809a92ba4ab95ad3a1b82a78be8c427

Download Submit
C:\Windows\Victima.exe
Filesize
136KB

MD5
86857643e3a2d4f5823491d5ab1acbe5

SHA1
a8be9490a9f3d81f36fe949e5d8b91260ae84884

SHA256
f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4

SHA512
1bfd90e53c580ee8c873b0fa4063a05d376910a62542ecea88f64798185c3cf294a9852c99dfb5e6010e656c4dcc189b4809a92ba4ab95ad3a1b82a78be8c427

Download Submit
C:\Windows\Victima.exe
Filesize
136KB

MD5
86857643e3a2d4f5823491d5ab1acbe5

SHA1
a8be9490a9f3d81f36fe949e5d8b91260ae84884

SHA256
f0817c04631133542352156f0a591595a55c16a410919d091c21e6193d63b2a4

SHA512
1bfd90e53c580ee8c873b0fa4063a05d376910a62542ecea88f64798185c3cf294a9852c99dfb5e6010e656c4dcc189b4809a92ba4ab95ad3a1b82a78be8c427

Download Submit
C:\Windows\cmsetac.dll
Filesize
33KB

MD5
d79df2b41858f399521132f65e2cd9d5

SHA1
d9d2fd2ed0076e4ba50311fa923d2a69d2c8d4ec

SHA256
7dfdc54dc219729636d3e7129fde82287b6744b59842df7b706b6c42eabeed4c

SHA512
6909e7893e5145a978fb59e56711d5d29c32e157948795e5ff7a10c9af1f1893b05246c357abaa322b964595d2c526086536dc90efc6f94fb7d27be096df15c7

Download Submit
C:\Windows\cmsetac.dll
Filesize
33KB

MD5
d79df2b41858f399521132f65e2cd9d5

SHA1
d9d2fd2ed0076e4ba50311fa923d2a69d2c8d4ec

SHA256
7dfdc54dc219729636d3e7129fde82287b6744b59842df7b706b6c42eabeed4c

SHA512
6909e7893e5145a978fb59e56711d5d29c32e157948795e5ff7a10c9af1f1893b05246c357abaa322b964595d2c526086536dc90efc6f94fb7d27be096df15c7

Download Submit
C:\Windows\ntdtcstp.dll
Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
C:\Windows\ntdtcstp.dll
Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
memory/2248-140-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2248-139-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2248-144-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2248-135-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2248-134-0x0000000000000000-mapping.dmp

Download
memory/2248-137-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2248-138-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3508-152-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3508-151-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3508-147-0x0000000000000000-mapping.dmp

Download
memory/3508-157-0x00000000031C0000-0x00000000031CE000-memory.dmp

Filesize
56KB

Download
memory/3508-158-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3508-159-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4496-141-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads