modiloader | f34392b29b9bd39501c0c8364873d48fddf65a655d3246827c439ab69eeae047

General

Target

92e4af16e475a6301aea40decf930965_JaffaCakes118.exe
Size

349KB
MD5

92e4af16e475a6301aea40decf930965
SHA1

096d24f2e5e5925ba4197565f20fb86a6a786d47
SHA256

f34392b29b9bd39501c0c8364873d48fddf65a655d3246827c439ab69eeae047
SHA512

fd0dbc89857f0d7acb732acafdfc61fb4cd0c6da08af274365063b87d35c28f2fa7776c273dbb3f543d2caf10e99b7a2221ffeea4216c8ab4d566739c2d736b2
SSDEEP

6144:kljq8bQCQN9b0syvR8r6PkJeBJejsKs6EPJId6LBtiMdeYv8rGYf14tpOLKRNLtI:18MCQDWQ0KOPDCModKYt474KDL8D

Score

10^/10

modiloader discovery evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

ModiLoader Second Stage 16 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023c8a-23.dat	modiloader_stage2
behavioral2/memory/2712-36-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4456-50-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4456-53-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4456-56-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4456-59-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4456-62-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4456-65-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4456-68-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4456-71-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4456-74-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4456-77-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4456-80-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4456-83-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4456-86-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4456-89-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Crypted by L1ghti.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Decrypted.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	92e4af16e475a6301aea40decf930965_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

pid	Process
4984	Crypted by L1ghti.exe
2712	Decrypted.exe
4456	mstwain32.exe

Loads dropped DLL 4 IoCs

pid	Process
4456	mstwain32.exe
4456	mstwain32.exe
4456	mstwain32.exe
4456	mstwain32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe"	mstwain32.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Decrypted.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstwain32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4252-0-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/4252-16-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\mstwain32.exe	Decrypted.exe
File opened for modification	C:\Windows\mstwain32.exe	Decrypted.exe
File created	C:\Windows\ntdtcstp.dll	mstwain32.exe
File created	C:\Windows\cmsetac.dll	mstwain32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92e4af16e475a6301aea40decf930965_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crypted by L1ghti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Decrypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mstwain32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	Decrypted.exe
Token: SeDebugPrivilege	4456	mstwain32.exe
Token: SeDebugPrivilege	4456	mstwain32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4984	Crypted by L1ghti.exe
4456	mstwain32.exe
4456	mstwain32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 4984	4252	92e4af16e475a6301aea40decf930965_JaffaCakes118.exe	83
PID 4252 wrote to memory of 4984	4252	92e4af16e475a6301aea40decf930965_JaffaCakes118.exe	83
PID 4252 wrote to memory of 4984	4252	92e4af16e475a6301aea40decf930965_JaffaCakes118.exe	83
PID 4984 wrote to memory of 2712	4984	Crypted by L1ghti.exe	84
PID 4984 wrote to memory of 2712	4984	Crypted by L1ghti.exe	84
PID 4984 wrote to memory of 2712	4984	Crypted by L1ghti.exe	84
PID 2712 wrote to memory of 4456	2712	Decrypted.exe	85
PID 2712 wrote to memory of 4456	2712	Decrypted.exe	85
PID 2712 wrote to memory of 4456	2712	Decrypted.exe	85

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

C:\Users\Admin\AppData\Local\Temp\92e4af16e475a6301aea40decf930965_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\92e4af16e475a6301aea40decf930965_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Users\Admin\AppData\Local\Temp\Crypted by L1ghti.exe
  "C:\Users\Admin\AppData\Local\Temp\Crypted by L1ghti.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Users\Admin\AppData\Local\Temp\Decrypted.exe
    "C:\Users\Admin\AppData\Local\Temp\Decrypted.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Windows\mstwain32.exe
      "C:\Windows\mstwain32.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:4456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Crypted by L1ghti.exe

Filesize
291KB

MD5
d6694475b71593c24ab2963b4e262935

SHA1
64e6494029c0fc4c2910c49d30acb2fe6d63d439

SHA256
b6f138597ce5371e8c41a12b4f8c94a6e9f771cb1c072824b7579ea23458dfee

SHA512
5ec68f97f919454d449b249b403a73b0720bc27329dc4645df184e0136224be9594233490926186f324768476d178667e51cee6e61e6c88889e83af73409025d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Decrypted.exe

Filesize
271KB

MD5
3da683a3b0deb6eb5374e9b8151abd04

SHA1
95d4d99bf6a1f4739f528be1393b28d7e23a70cf

SHA256
05d3dd97bcca5c691c87171a6138c8e62e4c088b597d0fe1d53445215d24ab3f

SHA512
cb25fdcc70b825917f6d621ba30a97e75e68902bf6f662b32772c6c5a6959c3c969e18963045d5210e728e5782bf8c792ae49cf7c93e751fabc81c1ef0865ecd

Download Submit
C:\Windows\cmsetac.dll

Filesize
33KB

MD5
1fd3a458b233acbf49d39b6a9ba38c31

SHA1
226905e672824ea74d184e57b883950229fd75a9

SHA256
57f00899b43fcb331866c344d517cd46ba2d63d56581f1de69803dd4adf47c70

SHA512
2e18df9b61c51f9531752accfa9f1caf84b94852d62640fcdb1af99534275f8a974b199e5fecaa838f405a9196bebdd1053991b2d086b3fece7464e2acc3c06e

Download Submit
C:\Windows\ntdtcstp.dll

Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
memory/2712-36-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4252-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4252-16-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4456-56-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4456-68-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4456-52-0x00000000030E0000-0x00000000030EE000-memory.dmp

Filesize
56KB

Download
memory/4456-51-0x0000000002120000-0x0000000002128000-memory.dmp

Filesize
32KB

Download
memory/4456-53-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4456-47-0x00000000030E0000-0x00000000030EE000-memory.dmp

Filesize
56KB

Download
memory/4456-59-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4456-62-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4456-65-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4456-50-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4456-71-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4456-74-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4456-77-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4456-80-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4456-83-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4456-86-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4456-89-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads