modiloader | f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8

General

Target

f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe
Size

126KB
MD5

936fe9b34f4d62c71364e856c0d73932
SHA1

3a80904cf58d500dcc9d908468896f81d3dbe40a
SHA256

f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8
SHA512

cf6ab831ee38cb7ae12d8cb2cba2f3e286c4ab69e50681cf6dfa8a516434e672a7a2ee2e1ffdb6ad1b21b97224dc8a3df3bfb0aeaa6691ec1bd13677f41bb2dc
SSDEEP

3072:Fkq53FivSwHKT0Wph5fJINzEprvcaAnB4vM2m3DMUsrfxK:2q0vDHABh1q1OrkJnB4i2Tw

Score

10^/10

modiloader evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

mstwain32.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

ModiLoader Second Stage 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1448-140-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral2/memory/1448-141-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral2/memory/1448-145-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral2/memory/2040-155-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral2/memory/2040-154-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2
behavioral2/memory/2040-161-0x0000000000400000-0x000000000044F000-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

Processes:

mstwain32.exemstwain32.exe

pid process

924 mstwain32.exe
2040 mstwain32.exe

pid	process
924	mstwain32.exe
2040	mstwain32.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4944-132-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/1448-136-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/1448-138-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/4944-139-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/1448-140-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/1448-141-0x0000000000400000-0x000000000044F000-memory.dmp	upx
C:\Windows\mstwain32.exe	upx
C:\Windows\mstwain32.exe	upx
behavioral2/memory/1448-145-0x0000000000400000-0x000000000044F000-memory.dmp	upx
C:\Windows\mstwain32.exe	upx
behavioral2/memory/924-153-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/2040-152-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/2040-155-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/2040-154-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral2/memory/2040-161-0x0000000000400000-0x000000000044F000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe

Loads dropped DLL 4 IoCs

Processes:

mstwain32.exe

pid process

2040 mstwain32.exe
2040 mstwain32.exe
2040 mstwain32.exe
2040 mstwain32.exe

pid	process
2040	mstwain32.exe
2040	mstwain32.exe
2040	mstwain32.exe
2040	mstwain32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

mstwain32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe"	mstwain32.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	mstwain32.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exemstwain32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstwain32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exemstwain32.exe

description	pid	process	target process
PID 4944 set thread context of 1448	4944	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe
PID 924 set thread context of 2040	924	mstwain32.exe	mstwain32.exe

Drops file in Windows directory 4 IoCs

Processes:

f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exemstwain32.exe

description	ioc	process
File created	C:\Windows\mstwain32.exe	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe
File opened for modification	C:\Windows\mstwain32.exe	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe
File created	C:\Windows\ntdtcstp.dll	mstwain32.exe
File created	C:\Windows\cmsetac.dll	mstwain32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exevssvc.exemstwain32.exe

description	pid	process
Token: SeDebugPrivilege	1448	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe
Token: SeBackupPrivilege	724	vssvc.exe
Token: SeRestorePrivilege	724	vssvc.exe
Token: SeAuditPrivilege	724	vssvc.exe
Token: SeDebugPrivilege	2040	mstwain32.exe
Token: SeDebugPrivilege	2040	mstwain32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exemstwain32.exemstwain32.exe

pid process

4944 f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe
924 mstwain32.exe
2040 mstwain32.exe
2040 mstwain32.exe

pid	process
4944	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe
924	mstwain32.exe
2040	mstwain32.exe
2040	mstwain32.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exef3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exemstwain32.exe

description	pid	process	target process
PID 4944 wrote to memory of 1448	4944	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe
PID 4944 wrote to memory of 1448	4944	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe
PID 4944 wrote to memory of 1448	4944	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe
PID 4944 wrote to memory of 1448	4944	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe
PID 4944 wrote to memory of 1448	4944	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe
PID 4944 wrote to memory of 1448	4944	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe
PID 4944 wrote to memory of 1448	4944	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe
PID 4944 wrote to memory of 1448	4944	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe
PID 1448 wrote to memory of 924	1448	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe	mstwain32.exe
PID 1448 wrote to memory of 924	1448	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe	mstwain32.exe
PID 1448 wrote to memory of 924	1448	f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe	mstwain32.exe
PID 924 wrote to memory of 2040	924	mstwain32.exe	mstwain32.exe
PID 924 wrote to memory of 2040	924	mstwain32.exe	mstwain32.exe
PID 924 wrote to memory of 2040	924	mstwain32.exe	mstwain32.exe
PID 924 wrote to memory of 2040	924	mstwain32.exe	mstwain32.exe
PID 924 wrote to memory of 2040	924	mstwain32.exe	mstwain32.exe
PID 924 wrote to memory of 2040	924	mstwain32.exe	mstwain32.exe
PID 924 wrote to memory of 2040	924	mstwain32.exe	mstwain32.exe
PID 924 wrote to memory of 2040	924	mstwain32.exe	mstwain32.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

mstwain32.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mstwain32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

C:\Users\Admin\AppData\Local\Temp\f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe
"C:\Users\Admin\AppData\Local\Temp\f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944

C:\Users\Admin\AppData\Local\Temp\f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe
C:\Users\Admin\AppData\Local\Temp\f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe
2⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\mstwain32.exe
"C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:924

C:\Windows\mstwain32.exe
C:\Windows\mstwain32.exe
4⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2040

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:724

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\cmsetac.dll
Filesize
33KB

MD5
ab15c74eb415ddfeeffbad91491f25fc

SHA1
5b12a12dfb3174fe5ea2ee18a553217c725e61ab

SHA256
6af73ee9bc4d81301f27801438c03a5e36849ad046a7993aef69e9004f869d69

SHA512
f40cbfa9848c98a8a975b4fe711b527016b5b0f1e6ab2abb0fe106724d0bb3338dd93a23fcb2cdc19d0d772981045884fdc50b9a2c01977a6947e0a7c9fad519

Download Submit
C:\Windows\cmsetac.dll
Filesize
33KB

MD5
ab15c74eb415ddfeeffbad91491f25fc

SHA1
5b12a12dfb3174fe5ea2ee18a553217c725e61ab

SHA256
6af73ee9bc4d81301f27801438c03a5e36849ad046a7993aef69e9004f869d69

SHA512
f40cbfa9848c98a8a975b4fe711b527016b5b0f1e6ab2abb0fe106724d0bb3338dd93a23fcb2cdc19d0d772981045884fdc50b9a2c01977a6947e0a7c9fad519

Download Submit
C:\Windows\mstwain32.exe
Filesize
126KB

MD5
936fe9b34f4d62c71364e856c0d73932

SHA1
3a80904cf58d500dcc9d908468896f81d3dbe40a

SHA256
f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8

SHA512
cf6ab831ee38cb7ae12d8cb2cba2f3e286c4ab69e50681cf6dfa8a516434e672a7a2ee2e1ffdb6ad1b21b97224dc8a3df3bfb0aeaa6691ec1bd13677f41bb2dc

Download Submit
C:\Windows\mstwain32.exe
Filesize
126KB

MD5
936fe9b34f4d62c71364e856c0d73932

SHA1
3a80904cf58d500dcc9d908468896f81d3dbe40a

SHA256
f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8

SHA512
cf6ab831ee38cb7ae12d8cb2cba2f3e286c4ab69e50681cf6dfa8a516434e672a7a2ee2e1ffdb6ad1b21b97224dc8a3df3bfb0aeaa6691ec1bd13677f41bb2dc

Download Submit
C:\Windows\mstwain32.exe
Filesize
126KB

MD5
936fe9b34f4d62c71364e856c0d73932

SHA1
3a80904cf58d500dcc9d908468896f81d3dbe40a

SHA256
f3686e1ceaedb3817c270fb1427bc864f06b71eb9de1a57e445d3ba162b9b5d8

SHA512
cf6ab831ee38cb7ae12d8cb2cba2f3e286c4ab69e50681cf6dfa8a516434e672a7a2ee2e1ffdb6ad1b21b97224dc8a3df3bfb0aeaa6691ec1bd13677f41bb2dc

Download Submit
C:\Windows\ntdtcstp.dll
Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
C:\Windows\ntdtcstp.dll
Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
memory/924-153-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/924-142-0x0000000000000000-mapping.dmp

Download
memory/1448-145-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1448-141-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1448-140-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1448-138-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1448-136-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1448-135-0x0000000000000000-mapping.dmp

Download
memory/2040-148-0x0000000000000000-mapping.dmp

Download
memory/2040-152-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2040-155-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2040-154-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2040-161-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4944-132-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4944-139-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads