modiloader | 44456e1849cfa44b87c8370c48a1f74d697448d6b95a47756553f1fab192766f

General

Target

f25207789f34470c9795aaf72baede45_JaffaCakes118.exe
Size

160KB
MD5

f25207789f34470c9795aaf72baede45
SHA1

8e9f0cfa32bd163a16002d72d81dfb8be62d0bc6
SHA256

44456e1849cfa44b87c8370c48a1f74d697448d6b95a47756553f1fab192766f
SHA512

3a8facff2da353a4185fc7fb30e0709f91af3d6fc06235ddbded94ec9fc5cb004075efa46edea4768db080643ce6d60bceea2e074281cda33221ef7f5985f181
SSDEEP

3072:+fJTydd6+BxWLUeunVTAz9jZkUWP5VxNL2lWO3hew7D9dDz:uydd8QVTMdZkUWxJL+d7Drz

Score

10^/10

modiloader discovery evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

ModiLoader Second Stage 18 IoCs

resource	yara_rule
behavioral2/memory/404-34-0x0000000000400000-0x0000000000448000-memory.dmp	modiloader_stage2
behavioral2/memory/4776-44-0x0000000000400000-0x0000000000448000-memory.dmp	modiloader_stage2
behavioral2/memory/404-42-0x0000000000400000-0x0000000000448000-memory.dmp	modiloader_stage2
behavioral2/memory/4776-52-0x0000000000400000-0x0000000000448000-memory.dmp	modiloader_stage2
behavioral2/memory/4776-54-0x0000000000400000-0x0000000000448000-memory.dmp	modiloader_stage2
behavioral2/memory/4776-55-0x0000000000400000-0x0000000000448000-memory.dmp	modiloader_stage2
behavioral2/memory/4776-57-0x0000000000400000-0x0000000000448000-memory.dmp	modiloader_stage2
behavioral2/memory/4776-59-0x0000000000400000-0x0000000000448000-memory.dmp	modiloader_stage2
behavioral2/memory/4776-61-0x0000000000400000-0x0000000000448000-memory.dmp	modiloader_stage2
behavioral2/memory/4776-63-0x0000000000400000-0x0000000000448000-memory.dmp	modiloader_stage2
behavioral2/memory/4776-65-0x0000000000400000-0x0000000000448000-memory.dmp	modiloader_stage2
behavioral2/memory/4776-67-0x0000000000400000-0x0000000000448000-memory.dmp	modiloader_stage2
behavioral2/memory/4776-69-0x0000000000400000-0x0000000000448000-memory.dmp	modiloader_stage2
behavioral2/memory/4776-71-0x0000000000400000-0x0000000000448000-memory.dmp	modiloader_stage2
behavioral2/memory/4776-73-0x0000000000400000-0x0000000000448000-memory.dmp	modiloader_stage2
behavioral2/memory/4776-75-0x0000000000400000-0x0000000000448000-memory.dmp	modiloader_stage2
behavioral2/memory/4776-77-0x0000000000400000-0x0000000000448000-memory.dmp	modiloader_stage2
behavioral2/memory/4776-79-0x0000000000400000-0x0000000000448000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	f25207789f34470c9795aaf72baede45_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	server.exe

Executes dropped EXE 3 IoCs

pid	Process
1600	Exploit Chams.exe
404	server.exe
4776	mstwain32.exe

Loads dropped DLL 2 IoCs

pid	Process
4776	mstwain32.exe
4776	mstwain32.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023c90-24.dat	upx
behavioral2/memory/404-34-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/4776-44-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/404-42-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/4776-52-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/4776-54-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/4776-55-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/4776-57-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/4776-59-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/4776-61-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/4776-63-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/4776-65-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/4776-67-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/4776-69-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/4776-71-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/4776-73-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/4776-75-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/4776-77-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/4776-79-0x0000000000400000-0x0000000000448000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe"	mstwain32.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	server.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstwain32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\mstwain32.exe	server.exe
File opened for modification	C:\Windows\mstwain32.exe	server.exe
File created	C:\Windows\ntdtcstp.dll	mstwain32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mstwain32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	404	server.exe
Token: SeDebugPrivilege	4776	mstwain32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4776	mstwain32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 1600	4200	f25207789f34470c9795aaf72baede45_JaffaCakes118.exe	89
PID 4200 wrote to memory of 1600	4200	f25207789f34470c9795aaf72baede45_JaffaCakes118.exe	89
PID 4200 wrote to memory of 404	4200	f25207789f34470c9795aaf72baede45_JaffaCakes118.exe	90
PID 4200 wrote to memory of 404	4200	f25207789f34470c9795aaf72baede45_JaffaCakes118.exe	90
PID 4200 wrote to memory of 404	4200	f25207789f34470c9795aaf72baede45_JaffaCakes118.exe	90
PID 404 wrote to memory of 4776	404	server.exe	91
PID 404 wrote to memory of 4776	404	server.exe	91
PID 404 wrote to memory of 4776	404	server.exe	91

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

C:\Users\Admin\AppData\Local\Temp\f25207789f34470c9795aaf72baede45_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f25207789f34470c9795aaf72baede45_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Users\Admin\AppData\Local\Temp\Exploit Chams.exe
  "C:\Users\Admin\AppData\Local\Temp\Exploit Chams.exe"
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\mstwain32.exe
    "C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\server.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:4776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Exploit Chams.exe

Filesize
40KB

MD5
4905e2edc9b05899ffdde135aa84f223

SHA1
508b7e595c9181b04e3f111ed9fa0128f7951b71

SHA256
dd3cc350a9623069263a64afb3454f4e05d80d909a37ec610bd36111ebf21662

SHA512
d7dac5c35a7b96cff7643ecdfe942a92f1ada9151f3b9e3c4eaf8a7b52c62609bd4eb052428f68096c9ce59db6c61c2372c731044d6c7a3b5b3e70dfe5fa041b

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe

Filesize
102KB

MD5
d024967ee0f8a8cb24dc4f9ae4dcc6e6

SHA1
a328ec251a00ff6ab52113bc7898ecadc760033e

SHA256
6ed9fa8fa1c8c12e6b0cf22818f3a7ae5657ecc30e427c4492cb67df4dee8e68

SHA512
685a533004ee411112819b2fdbf8f10e8d30cb9dd76e2ccf0a29961f3702d83caaadba372a31f937745d273f05bfac3edbe25d50314787b062855563bd655454

Download Submit
C:\Windows\ntdtcstp.dll

Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
memory/404-42-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/404-34-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1600-51-0x00007FF8FCE60000-0x00007FF8FD801000-memory.dmp

Filesize
9.6MB

Download
memory/1600-30-0x00007FF8FCE60000-0x00007FF8FD801000-memory.dmp

Filesize
9.6MB

Download
memory/1600-28-0x00007FF8FCE60000-0x00007FF8FD801000-memory.dmp

Filesize
9.6MB

Download
memory/1600-32-0x00007FF8FCE60000-0x00007FF8FD801000-memory.dmp

Filesize
9.6MB

Download
memory/4200-7-0x000000001C6C0000-0x000000001C70C000-memory.dmp

Filesize
304KB

Download
memory/4200-1-0x000000001BA70000-0x000000001BB16000-memory.dmp

Filesize
664KB

Download
memory/4200-3-0x00007FF8FCE60000-0x00007FF8FD801000-memory.dmp

Filesize
9.6MB

Download
memory/4200-31-0x00007FF8FCE60000-0x00007FF8FD801000-memory.dmp

Filesize
9.6MB

Download
memory/4200-8-0x00007FF8FCE60000-0x00007FF8FD801000-memory.dmp

Filesize
9.6MB

Download
memory/4200-2-0x00007FF8FCE60000-0x00007FF8FD801000-memory.dmp

Filesize
9.6MB

Download
memory/4200-0-0x00007FF8FD115000-0x00007FF8FD116000-memory.dmp

Filesize
4KB

Download
memory/4200-5-0x000000001C560000-0x000000001C5FC000-memory.dmp

Filesize
624KB

Download
memory/4200-4-0x000000001BFF0000-0x000000001C4BE000-memory.dmp

Filesize
4.8MB

Download
memory/4200-6-0x0000000001210000-0x0000000001218000-memory.dmp

Filesize
32KB

Download
memory/4776-52-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4776-65-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4776-54-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4776-53-0x0000000001FB0000-0x0000000001FB8000-memory.dmp

Filesize
32KB

Download
memory/4776-55-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4776-57-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4776-59-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4776-61-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4776-63-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4776-44-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4776-67-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4776-69-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4776-71-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4776-73-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4776-75-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4776-77-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4776-79-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads