modiloader | f34392b29b9bd39501c0c8364873d48fddf65a655d3246827c439ab69eeae047

General

Target

92e4af16e475a6301aea40decf930965_JaffaCakes118.exe
Size

349KB
MD5

92e4af16e475a6301aea40decf930965
SHA1

096d24f2e5e5925ba4197565f20fb86a6a786d47
SHA256

f34392b29b9bd39501c0c8364873d48fddf65a655d3246827c439ab69eeae047
SHA512

fd0dbc89857f0d7acb732acafdfc61fb4cd0c6da08af274365063b87d35c28f2fa7776c273dbb3f543d2caf10e99b7a2221ffeea4216c8ab4d566739c2d736b2
SSDEEP

6144:kljq8bQCQN9b0syvR8r6PkJeBJejsKs6EPJId6LBtiMdeYv8rGYf14tpOLKRNLtI:18MCQDWQ0KOPDCModKYt474KDL8D

Score

10^/10

modiloader discovery evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

mstwain32.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

ModiLoader Second Stage 16 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000700000001921d-28.dat	modiloader_stage2
behavioral1/memory/2688-41-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2708-52-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2708-56-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2708-60-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2708-64-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2708-68-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2708-72-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2708-76-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2708-80-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2708-84-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2708-88-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2708-92-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2708-96-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2708-100-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2708-104-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2

Executes dropped EXE 3 IoCs

Processes:

Crypted by L1ghti.exeDecrypted.exemstwain32.exe

pid	Process
1604	Crypted by L1ghti.exe
2688	Decrypted.exe
2708	mstwain32.exe

Loads dropped DLL 5 IoCs

Processes:

92e4af16e475a6301aea40decf930965_JaffaCakes118.exeCrypted by L1ghti.exeDecrypted.exe

pid	Process
2224	92e4af16e475a6301aea40decf930965_JaffaCakes118.exe
2224	92e4af16e475a6301aea40decf930965_JaffaCakes118.exe
1604	Crypted by L1ghti.exe
1604	Crypted by L1ghti.exe
2688	Decrypted.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

mstwain32.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe"	mstwain32.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Decrypted.exemstwain32.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Decrypted.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstwain32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2224-4-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/2224-17-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

Processes:

mstwain32.exeDecrypted.exe

description	ioc	Process
File created	C:\Windows\cmsetac.dll	mstwain32.exe
File created	C:\Windows\mstwain32.exe	Decrypted.exe
File opened for modification	C:\Windows\mstwain32.exe	Decrypted.exe
File created	C:\Windows\ntdtcstp.dll	mstwain32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Crypted by L1ghti.exeDecrypted.exemstwain32.exe92e4af16e475a6301aea40decf930965_JaffaCakes118.exeDllHost.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crypted by L1ghti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Decrypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mstwain32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92e4af16e475a6301aea40decf930965_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Decrypted.exemstwain32.exeDllHost.exe

description	pid	Process
Token: SeDebugPrivilege	2688	Decrypted.exe
Token: SeDebugPrivilege	2708	mstwain32.exe
Token: SeDebugPrivilege	2708	mstwain32.exe
Token: SeDebugPrivilege	2848	DllHost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid	Process
2848	DllHost.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

Crypted by L1ghti.exemstwain32.exeDllHost.exe

pid	Process
1604	Crypted by L1ghti.exe
2708	mstwain32.exe
2708	mstwain32.exe
2848	DllHost.exe
2848	DllHost.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

92e4af16e475a6301aea40decf930965_JaffaCakes118.exeCrypted by L1ghti.exeDecrypted.exe

description	pid	Process	procid_target
PID 2224 wrote to memory of 1604	2224	92e4af16e475a6301aea40decf930965_JaffaCakes118.exe	32
PID 2224 wrote to memory of 1604	2224	92e4af16e475a6301aea40decf930965_JaffaCakes118.exe	32
PID 2224 wrote to memory of 1604	2224	92e4af16e475a6301aea40decf930965_JaffaCakes118.exe	32
PID 2224 wrote to memory of 1604	2224	92e4af16e475a6301aea40decf930965_JaffaCakes118.exe	32
PID 1604 wrote to memory of 2688	1604	Crypted by L1ghti.exe	33
PID 1604 wrote to memory of 2688	1604	Crypted by L1ghti.exe	33
PID 1604 wrote to memory of 2688	1604	Crypted by L1ghti.exe	33
PID 1604 wrote to memory of 2688	1604	Crypted by L1ghti.exe	33
PID 2688 wrote to memory of 2708	2688	Decrypted.exe	34
PID 2688 wrote to memory of 2708	2688	Decrypted.exe	34
PID 2688 wrote to memory of 2708	2688	Decrypted.exe	34
PID 2688 wrote to memory of 2708	2688	Decrypted.exe	34

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

mstwain32.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

C:\Users\Admin\AppData\Local\Temp\92e4af16e475a6301aea40decf930965_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\92e4af16e475a6301aea40decf930965_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\Crypted by L1ghti.exe
  "C:\Users\Admin\AppData\Local\Temp\Crypted by L1ghti.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Users\Admin\AppData\Local\Temp\Decrypted.exe
    "C:\Users\Admin\AppData\Local\Temp\Decrypted.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\mstwain32.exe
      "C:\Windows\mstwain32.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:2708

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Crypted by L1ghti.exe

Filesize
291KB

MD5
d6694475b71593c24ab2963b4e262935

SHA1
64e6494029c0fc4c2910c49d30acb2fe6d63d439

SHA256
b6f138597ce5371e8c41a12b4f8c94a6e9f771cb1c072824b7579ea23458dfee

SHA512
5ec68f97f919454d449b249b403a73b0720bc27329dc4645df184e0136224be9594233490926186f324768476d178667e51cee6e61e6c88889e83af73409025d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Decrypted.exe

Filesize
271KB

MD5
3da683a3b0deb6eb5374e9b8151abd04

SHA1
95d4d99bf6a1f4739f528be1393b28d7e23a70cf

SHA256
05d3dd97bcca5c691c87171a6138c8e62e4c088b597d0fe1d53445215d24ab3f

SHA512
cb25fdcc70b825917f6d621ba30a97e75e68902bf6f662b32772c6c5a6959c3c969e18963045d5210e728e5782bf8c792ae49cf7c93e751fabc81c1ef0865ecd

Download Submit
C:\Users\Admin\AppData\Local\Temp\sTWYol286173-02.jpg

Filesize
49KB

MD5
767fa1dac3ae03a7fb3db528ecf6bf11

SHA1
a9e8b5efc996aba8fc5f5a88607dc56a529511c9

SHA256
35a9fd33078fc0ba5d3b53610d1cfc86deab3886b4955cefe7565ba64ff03a19

SHA512
b6774e9f2d4fcb9c2a7c38f39895209849a7cf5fb83ee2f620ee9c796e9ea43be083bc401a343a8b388af3f05a0952477b810ac1e2960b2f0e9f98c8f9fe5a89

Download Submit
C:\Windows\cmsetac.dll

Filesize
33KB

MD5
1fd3a458b233acbf49d39b6a9ba38c31

SHA1
226905e672824ea74d184e57b883950229fd75a9

SHA256
57f00899b43fcb331866c344d517cd46ba2d63d56581f1de69803dd4adf47c70

SHA512
2e18df9b61c51f9531752accfa9f1caf84b94852d62640fcdb1af99534275f8a974b199e5fecaa838f405a9196bebdd1053991b2d086b3fece7464e2acc3c06e

Download Submit
memory/2224-5-0x00000000029C0000-0x00000000029C2000-memory.dmp

Filesize
8KB

Download
memory/2224-4-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2224-17-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2688-41-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2708-53-0x00000000004A0000-0x00000000004A8000-memory.dmp

Filesize
32KB

Download
memory/2708-84-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2708-45-0x0000000000720000-0x000000000072E000-memory.dmp

Filesize
56KB

Download
memory/2708-104-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2708-100-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2708-96-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2708-92-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2708-52-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2708-54-0x0000000000720000-0x000000000072E000-memory.dmp

Filesize
56KB

Download
memory/2708-56-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2708-60-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2708-64-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2708-68-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2708-72-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2708-76-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2708-80-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2708-88-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2848-48-0x0000000000730000-0x000000000073E000-memory.dmp

Filesize
56KB

Download
memory/2848-6-0x0000000000330000-0x0000000000332000-memory.dmp

Filesize
8KB

Download
memory/2848-51-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/2848-50-0x0000000000730000-0x000000000073E000-memory.dmp

Filesize
56KB

Download
memory/2848-9-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads