modiloader | b26eb01f6ceedd46a8d8d9396cde9fad80ac38fbb0ba2a818e7e39ba53a3c46a

Analysis

max time kernel
142s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Illy_Deactovator_crackd_by__ghost_/Illy Deactovator crackd by VAMPAIRE/cracked.exe
Size

268KB
MD5

acfb0633530a15ff5a32e078b2def812
SHA1

4920d9cd7db08e4b455e91a3930b6c7a862bf2c6
SHA256

e31ec0cb989c40190f0bfe96ac42d564cc4f6a5227cf319a2f4f82d313cf1ca3
SHA512

612ad0d4da0870f871f9bb94c6f4e4dbca952e246c9d3f30423b0205a41a51c269377369ea2e4a96ee11d8676fd4cc35adbe7a5446342ce3ad904f7e29085b95
SSDEEP

6144:cjbeiQjLnXIHdwl+aXNb9bsmyZO+kzK0g:cuTsKp9tIO+YK

Score

10^/10

modiloader discovery evasion persistence trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

ModiLoader Second Stage 19 IoCs

resource	yara_rule
behavioral1/memory/2284-37-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2284-38-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2284-47-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1516-63-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1516-64-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1516-70-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1516-73-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1516-74-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1516-77-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1516-80-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1516-83-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1516-87-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1516-90-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1516-93-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1516-96-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1516-99-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1516-102-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1516-105-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/1516-108-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2

Executes dropped EXE 5 IoCs

pid	Process
2468	cracked.exe
2744	server.exe
2284	server.exe
1552	mstwain32.exe
1516	mstwain32.exe

Loads dropped DLL 4 IoCs

pid	Process
2640	cracked.exe
2640	cracked.exe
2640	cracked.exe
2744	server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	cracked.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe"	mstwain32.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	server.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstwain32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2744 set thread context of 2284	2744	server.exe	32
PID 1552 set thread context of 1516	1552	mstwain32.exe	37

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2284-26-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2284-32-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2284-29-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2284-25-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2284-36-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2284-37-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2284-38-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2284-47-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1516-62-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1516-63-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1516-64-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1516-70-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1516-73-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1516-74-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1516-77-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1516-80-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1516-83-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1516-87-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1516-90-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1516-93-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1516-96-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1516-99-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1516-102-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1516-105-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/1516-108-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\mstwain32.exe	server.exe
File opened for modification	C:\Windows\mstwain32.exe	server.exe
File opened for modification	C:\Windows\mstwain32.exe	mstwain32.exe
File created	C:\Windows\ntdtcstp.dll	mstwain32.exe
File created	C:\Windows\cmsetac.dll	mstwain32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cracked.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cracked.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mstwain32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mstwain32.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	server.exe
Token: SeBackupPrivilege	2676	vssvc.exe
Token: SeRestorePrivilege	2676	vssvc.exe
Token: SeAuditPrivilege	2676	vssvc.exe
Token: SeDebugPrivilege	1516	mstwain32.exe
Token: SeDebugPrivilege	1516	mstwain32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2468	cracked.exe
2744	server.exe
1552	mstwain32.exe
1516	mstwain32.exe
1516	mstwain32.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2468	2640	cracked.exe	30
PID 2640 wrote to memory of 2468	2640	cracked.exe	30
PID 2640 wrote to memory of 2468	2640	cracked.exe	30
PID 2640 wrote to memory of 2468	2640	cracked.exe	30
PID 2640 wrote to memory of 2744	2640	cracked.exe	31
PID 2640 wrote to memory of 2744	2640	cracked.exe	31
PID 2640 wrote to memory of 2744	2640	cracked.exe	31
PID 2640 wrote to memory of 2744	2640	cracked.exe	31
PID 2744 wrote to memory of 2284	2744	server.exe	32
PID 2744 wrote to memory of 2284	2744	server.exe	32
PID 2744 wrote to memory of 2284	2744	server.exe	32
PID 2744 wrote to memory of 2284	2744	server.exe	32
PID 2744 wrote to memory of 2284	2744	server.exe	32
PID 2744 wrote to memory of 2284	2744	server.exe	32
PID 2744 wrote to memory of 2284	2744	server.exe	32
PID 2744 wrote to memory of 2284	2744	server.exe	32
PID 2284 wrote to memory of 1552	2284	server.exe	36
PID 2284 wrote to memory of 1552	2284	server.exe	36
PID 2284 wrote to memory of 1552	2284	server.exe	36
PID 2284 wrote to memory of 1552	2284	server.exe	36
PID 1552 wrote to memory of 1516	1552	mstwain32.exe	37
PID 1552 wrote to memory of 1516	1552	mstwain32.exe	37
PID 1552 wrote to memory of 1516	1552	mstwain32.exe	37
PID 1552 wrote to memory of 1516	1552	mstwain32.exe	37
PID 1552 wrote to memory of 1516	1552	mstwain32.exe	37
PID 1552 wrote to memory of 1516	1552	mstwain32.exe	37
PID 1552 wrote to memory of 1516	1552	mstwain32.exe	37
PID 1552 wrote to memory of 1516	1552	mstwain32.exe	37

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Illy_Deactovator_crackd_by__ghost_\Illy Deactovator crackd by VAMPAIRE\cracked.exe
"C:\Users\Admin\AppData\Local\Temp\Illy_Deactovator_crackd_by__ghost_\Illy Deactovator crackd by VAMPAIRE\cracked.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cracked.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cracked.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2468
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
    "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Windows\mstwain32.exe
      "C:\Windows\mstwain32.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1552
    - - C:\Windows\mstwain32.exe
        
        "C:\Windows\mstwain32.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1516

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cracked.exe

Filesize
136KB

MD5
80e37501682c6b45be188c219eacd841

SHA1
e925301c2ce453af6d3294a174b5977305336a5b

SHA256
2a9dd4e7269143025a0f005f22d7382cf728978e668503ce3220f39bb7d24bb6

SHA512
e70695bbca295ac7d956038a6a30933ea88abe403372efc309808087a055bca606f2a68691758a39587f4c0aedadae3ed5c389b6a366f98c267de786fbab7567

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe

Filesize
200KB

MD5
d59fa05df32a428b6a304884d9ea510f

SHA1
4520fd3a9c0e3f05f19ecc8cc182b48ca5d46d7c

SHA256
259f00944ff3d54b314438d4aafb265345a80be38adc5ba400da63dbed69125f

SHA512
5ae9d014165ab5fac97dfd9e4cdb516ea3c12eaf7468a94afad90e9d029e828129a67cd49feffcc1fc0bb81d903eb7536da2ae26ea6bfbceba579b1a987ed07a

Download Submit
memory/1516-80-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1516-87-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1516-108-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1516-64-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1516-63-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1516-68-0x0000000002220000-0x000000000222E000-memory.dmp

Filesize
56KB

Download
memory/1516-102-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1516-99-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1516-96-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1516-93-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1516-90-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1516-72-0x0000000002220000-0x000000000222E000-memory.dmp

Filesize
56KB

Download
memory/1516-83-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1516-73-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1516-70-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1516-62-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1516-105-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1516-77-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1516-74-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1516-71-0x0000000000850000-0x0000000000858000-memory.dmp

Filesize
32KB

Download
memory/1552-60-0x0000000000400000-0x0000000000417001-memory.dmp

Filesize
92KB

Download
memory/1552-59-0x0000000000250000-0x0000000000268000-memory.dmp

Filesize
96KB

Download
memory/2284-26-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2284-32-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2284-47-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2284-38-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2284-37-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2284-36-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2284-25-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2284-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2284-29-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2284-23-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2640-14-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2744-18-0x0000000000400000-0x0000000000417001-memory.dmp

Filesize
92KB

Download
memory/2744-33-0x0000000000400000-0x0000000000417001-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads