modiloader | a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273

General

Target

a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273.exe
Size

126KB
MD5

b5f1d0e08a91d987dea414fd5a8e001b
SHA1

fc051e729d9a99de070f265164bf3638acb7ac8c
SHA256

a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273
SHA512

c27350ec7603bc0511189b37273d1ccba4f1433d4e7b6e33262632af480c98cc8984a7fbd072586feb61c3608d1d804fd3774beb610de9e87f67c0dc2d9268e4
SSDEEP

3072:A3JzTHTTmObj0TrnFt9c4wsdMhuEkGZ14kpaKrdaQHLA05:SJrTmk011wsqkGZ11oS5

Score

10^/10

modiloader evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

ModiLoader Second Stage 6 IoCs

resource	yara_rule
behavioral2/memory/5068-136-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/5068-137-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/5068-138-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/5068-150-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/1940-151-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral2/memory/1940-155-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

pid	Process
4012	mstwain32.exe
1940	mstwain32.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5068-133-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/5068-135-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/5068-136-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/5068-137-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/5068-138-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/5068-150-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1940-151-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/memory/1940-155-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273.exe

Loads dropped DLL 4 IoCs

pid	Process
1940	mstwain32.exe
1940	mstwain32.exe
1940	mstwain32.exe
1940	mstwain32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	mstwain32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe"	mstwain32.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstwain32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1140 set thread context of 5068	1140	a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273.exe	81
PID 4012 set thread context of 1940	4012	mstwain32.exe	89

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\mstwain32.exe	a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273.exe
File opened for modification	C:\Windows\mstwain32.exe	a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273.exe
File created	C:\Windows\ntdtcstp.dll	mstwain32.exe
File created	C:\Windows\cmsetac.dll	mstwain32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5068	a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273.exe
Token: SeBackupPrivilege	3668	vssvc.exe
Token: SeRestorePrivilege	3668	vssvc.exe
Token: SeAuditPrivilege	3668	vssvc.exe
Token: SeDebugPrivilege	1940	mstwain32.exe
Token: SeDebugPrivilege	1940	mstwain32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1940	mstwain32.exe
1940	mstwain32.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 5068	1140	a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273.exe	81
PID 1140 wrote to memory of 5068	1140	a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273.exe	81
PID 1140 wrote to memory of 5068	1140	a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273.exe	81
PID 1140 wrote to memory of 5068	1140	a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273.exe	81
PID 1140 wrote to memory of 5068	1140	a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273.exe	81
PID 5068 wrote to memory of 4012	5068	a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273.exe	87
PID 5068 wrote to memory of 4012	5068	a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273.exe	87
PID 5068 wrote to memory of 4012	5068	a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273.exe	87
PID 4012 wrote to memory of 1940	4012	mstwain32.exe	89
PID 4012 wrote to memory of 1940	4012	mstwain32.exe	89
PID 4012 wrote to memory of 1940	4012	mstwain32.exe	89
PID 4012 wrote to memory of 1940	4012	mstwain32.exe	89
PID 4012 wrote to memory of 1940	4012	mstwain32.exe	89

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

C:\Users\Admin\AppData\Local\Temp\a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273.exe
"C:\Users\Admin\AppData\Local\Temp\a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Local\Temp\a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273.exe
  C:\Users\Admin\AppData\Local\Temp\a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273.exe
  2⤵
  - Checks computer location settings
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\mstwain32.exe
    "C:\Windows\mstwain32.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Windows\mstwain32.exe
      C:\Windows\mstwain32.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:1940

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\cmsetac.dll

Filesize
33KB

MD5
971733a3a7b0a38e400953cb804fa780

SHA1
f25449258d4d0ca153434c8b142feeb959a86d61

SHA256
b48fdd003a462f9e597f259621f3d5bd604b912c6fcb1c6060f8ad9665a65a24

SHA512
989c026fe9b16b149b6e1d09812996d8c352b32f0cf34150b00da3a2d533ceb8f77de13b8376d9cf356a03cb1de02557c38f851398e21aebebdad5423bb0b7b8

Download Submit
C:\Windows\cmsetac.dll

Filesize
33KB

MD5
971733a3a7b0a38e400953cb804fa780

SHA1
f25449258d4d0ca153434c8b142feeb959a86d61

SHA256
b48fdd003a462f9e597f259621f3d5bd604b912c6fcb1c6060f8ad9665a65a24

SHA512
989c026fe9b16b149b6e1d09812996d8c352b32f0cf34150b00da3a2d533ceb8f77de13b8376d9cf356a03cb1de02557c38f851398e21aebebdad5423bb0b7b8

Download Submit
C:\Windows\mstwain32.exe

Filesize
126KB

MD5
b5f1d0e08a91d987dea414fd5a8e001b

SHA1
fc051e729d9a99de070f265164bf3638acb7ac8c

SHA256
a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273

SHA512
c27350ec7603bc0511189b37273d1ccba4f1433d4e7b6e33262632af480c98cc8984a7fbd072586feb61c3608d1d804fd3774beb610de9e87f67c0dc2d9268e4

Download Submit
C:\Windows\mstwain32.exe

Filesize
126KB

MD5
b5f1d0e08a91d987dea414fd5a8e001b

SHA1
fc051e729d9a99de070f265164bf3638acb7ac8c

SHA256
a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273

SHA512
c27350ec7603bc0511189b37273d1ccba4f1433d4e7b6e33262632af480c98cc8984a7fbd072586feb61c3608d1d804fd3774beb610de9e87f67c0dc2d9268e4

Download Submit
C:\Windows\mstwain32.exe

Filesize
126KB

MD5
b5f1d0e08a91d987dea414fd5a8e001b

SHA1
fc051e729d9a99de070f265164bf3638acb7ac8c

SHA256
a5b7dc11fc31e89c8163493517dce21a47716247ab9a99ccbe7b05e3e0c4a273

SHA512
c27350ec7603bc0511189b37273d1ccba4f1433d4e7b6e33262632af480c98cc8984a7fbd072586feb61c3608d1d804fd3774beb610de9e87f67c0dc2d9268e4

Download Submit
C:\Windows\ntdtcstp.dll

Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
C:\Windows\ntdtcstp.dll

Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
memory/1940-142-0x0000000000000000-mapping.dmp

Download
memory/1940-151-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1940-154-0x0000000002480000-0x000000000248E000-memory.dmp

Filesize
56KB

Download
memory/1940-155-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4012-139-0x0000000000000000-mapping.dmp

Download
memory/5068-138-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5068-137-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5068-136-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5068-132-0x0000000000000000-mapping.dmp

Download
memory/5068-150-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5068-135-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5068-133-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads