modiloader | c3f724d793cecd6710e248600b7e721d808a4fef654e569f1e749fa81444420f

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_c3f724d793cecd6710e248600b7e721d808a4fef654e569f1e749fa81444420f.exe
Size 716KB
Sample260925-d3gfvaybmf
SHA256 c3f724d793cecd6710e248600b7e721d808a4fef654e569f1e749fa81444420f
MD5 50c7b743f981bad39a8c1b9eb48aff82
SHA1 ed442a7eda3da4c2e96d472a5f18a351f1c8bcb6
SHA512 cdd54ea959c9a4c0e7e4cf9baba58840426e7c69b6e6229ce19fdc3a5b752f9f4e6c75c301e1bba30d09fff4b7e7e7f5f5cd9944725b0586d6bebf9986e3752a
SSDEEP 12288:pQUbn1Z91Ca3bMcrDPUCUnDP2x7iBqmWdRAG6+B7jR2jUuhtTKw0e0F5U7O0M:Bb13sa3bMcrTJGDPx4mmxhT4TKw0eOJ
TLSH
T1DFF41265F3A5049BD1B6897C5C7BB79D8E69BE017231CD7D2655B8CF28B8300C86832B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery modiloader persistence ransomware trojan

Malware Config

Signatures

Family: ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 6 IoCs

resource	yara_rule
behavioral2/memory/4708-18-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral2/memory/4708-20-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral2/memory/4708-22-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral2/memory/2228-29-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral2/memory/2228-30-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2
behavioral2/memory/2228-42-0x0000000000400000-0x000000000044C000-memory.dmp	modiloader_stage2

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

Executes dropped EXE 6 IoCs

pid	Process
4784	haZ-UD.exe
4708	haZ-UD.exe
2356	mstwain32.exe
2228	mstwain32.exe
3284	mstwain32.exe
2736	mstwain32.exe

Loads dropped DLL 7 IoCs

pid	Process
2228	mstwain32.exe
2228	mstwain32.exe
2228	mstwain32.exe
2228	mstwain32.exe
3284	mstwain32.exe
3284	mstwain32.exe
3328	mspaint.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe"	mstwain32.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	haZ-UD.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstwain32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4784 set thread context of 4708	4784	haZ-UD.exe	91
PID 2356 set thread context of 2228	2356	mstwain32.exe	100
PID 3284 set thread context of 2736	3284	mstwain32.exe	103

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\ntdtcstp.dll	mstwain32.exe
File created	C:\Windows\cmsetac.dll	mstwain32.exe
File created	C:\Windows\mstwain32.exe	haZ-UD.exe
File opened for modification	C:\Windows\mstwain32.exe	haZ-UD.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_c3f724d793cecd6710e248600b7e721d808a4fef654e569f1e749fa81444420f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mstwain32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mstwain32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mstwain32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	haZ-UD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	haZ-UD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mstwain32.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings	jaffacakes118_c3f724d793cecd6710e248600b7e721d808a4fef654e569f1e749fa81444420f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3328	mspaint.exe
3328	mspaint.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4708	haZ-UD.exe
Token: SeBackupPrivilege	4744	vssvc.exe
Token: SeRestorePrivilege	4744	vssvc.exe
Token: SeAuditPrivilege	4744	vssvc.exe
Token: SeDebugPrivilege	2228	mstwain32.exe
Token: SeDebugPrivilege	2228	mstwain32.exe
Token: SeDebugPrivilege	3284	mstwain32.exe
Token: SeDebugPrivilege	3328	mspaint.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3328	mspaint.exe
3328	mspaint.exe
3328	mspaint.exe
3328	mspaint.exe
2228	mstwain32.exe
2228	mstwain32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 3328	3480	jaffacakes118_c3f724d793cecd6710e248600b7e721d808a4fef654e569f1e749fa81444420f.exe	89
PID 3480 wrote to memory of 4784	3480	jaffacakes118_c3f724d793cecd6710e248600b7e721d808a4fef654e569f1e749fa81444420f.exe	90
PID 4784 wrote to memory of 4708	4784	haZ-UD.exe	91
PID 4784 wrote to memory of 4708	4784	haZ-UD.exe	91
PID 4708 wrote to memory of 2356	4708	haZ-UD.exe	99
PID 2356 wrote to memory of 2228	2356	mstwain32.exe	100
PID 2356 wrote to memory of 2228	2356	mstwain32.exe	100
PID 3284 wrote to memory of 2736	3284	mstwain32.exe	103
PID 3284 wrote to memory of 2736	3284	mstwain32.exe	103

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c3f724d793cecd6710e248600b7e721d808a4fef654e569f1e749fa81444420f.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c3f724d793cecd6710e248600b7e721d808a4fef654e569f1e749fa81444420f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\SysWOW64\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Günbatýmý.jpg"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3328
- C:\Users\Admin\AppData\Local\Temp\haZ-UD.exe
  "C:\Users\Admin\AppData\Local\Temp\haZ-UD.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Users\Admin\AppData\Local\Temp\haZ-UD.exe
    C:\Users\Admin\AppData\Local\Temp\haZ-UD.exe
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\mstwain32.exe
      "C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\haZ-UD.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2356
    - - C:\Windows\mstwain32.exe
        
        C:\Windows\mstwain32.exe
        5⤵
        UAC bypass
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:5360

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\Windows\mstwain32.exe
C:\Windows\mstwain32.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\mstwain32.exe
  C:\Windows\mstwain32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Günbatýmý.jpg

Path C:\Users\Admin\AppData\Local\Temp\Günbatýmý.jpg
Size 69KB
SHA256 ea3b1238a38f72b330aac53364bd0a0481946b93fc757dde7314ce3319f1840e
MD5 1bc5b77f3e50b7fbe12c792ee438da45
SHA1 5bd2ef6030d665aa615147512a0fea3055930cc6
SHA512 62139dfa1f200687b847462c76ff4979c4892ecfe65ff5e8c06822ca771da3bd3db472aa8bdaa61b4ba359e493cf51882f9731e3fbfa2d496dac8cba03332905
SSDEEP 1536:kBpX5vPL618m2uncVBVPO6nRvhJDgUh0JgrUdnXT:kBlIymvcPM6n3xVUB
TLSH
T1A263013A2D78C990C2E8FE726241B588A7794D26A37F2C2D4F1B792734FE145E852317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

haZ-UD.exe

Path C:\Users\Admin\AppData\Local\Temp\haZ-UD.exe
Size 633KB
SHA256 90cf61447c67073be97d23ec4f3ef0f0843a493e6e3ef7348f921443fdf219ff
MD5 103a1b2da7e9fd2571881874e83549a3
SHA1 ae3e85f427a2c10f2d61ef3f8d13dda8e21ae933
SHA512 30b3abf57604cb420a188097149f7c714095e3933f92900db1ee484ea582283984c5a7a3efe1629471773241ff26efd885179f268003b0e9f140a578d4acba46
SSDEEP 12288:tQUbn1Z91Ca3bMcrDPUCUnDP2x7iBqmWdRAG6+B7jR2jUuhtTKw0e0F5Ue:tb13sa3bMcrTJGDPx4mmxhT4TKw0eOD
TLSH
T1E0D412A5F3A5058AD577893C5C7BB79D8E6ABE017230CE7D2151B8CE2878704C4A833B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmsetac.dll

Path C:\Windows\cmsetac.dll
Size 33KB
SHA256 72bd75801ccc15230e50e2c3c11e742996207a513dda8e80703290697850881d
MD5 df40203c3a6ccfc23a62673de7bd22a3
SHA1 7ed710e15a440c18d160c6eaf7433aff567c0c34
SHA512 44364f00a3b36cbcc4243802fb9bf83f7d72d9751d689807a7408c15e83acb10dbb1884147f4fc0c81c00c444caf0c8ccf4fe2db09ff1f06ccecbc4279348549
SSDEEP 768:P+aoi6qZOpQB5ZpOc06HCMN9GT6RJ5BHUEy2YEZZEo:P+av6qZ4QxpP0AtNfRJ5BHxY
TLSH
T1C5E25B52FBC1C476D020CDFC5D15C258AB7AB5202C769D6B79ED2FCEED2A282015D1C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntdtcstp.dll

Path C:\Windows\ntdtcstp.dll
Size 7KB
SHA256 e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
MD5 67587e25a971a141628d7f07bd40ffa0
SHA1 76fcd014539a3bb247cc0b761225f68bd6055f6b
SHA512 6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350
SSDEEP 96:nPI4WiJu8aFwiFtih01Rl532eJWahK4oDImBx:ndW0u8/Jh0Dl532eJWao4i/
TLSH
T15FE1C602BE8149F3CAC4D4BCACADA25DF37E2130AEA57442D98E03DDDC9D3615A1C942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2228-29-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/2228-57-0x00000000025D0000-0x00000000025DE000-memory.dmp

Download

memory/2228-56-0x0000000000A90000-0x0000000000A98000-memory.dmp

Download

memory/2228-42-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/2228-40-0x00000000025D0000-0x00000000025DE000-memory.dmp

Download

memory/2228-30-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/2356-28-0x0000000063400000-0x000000006345EE00-memory.dmp

Download

memory/3284-48-0x00000000021E0000-0x00000000021EE000-memory.dmp

Download

memory/3284-44-0x0000000063400000-0x000000006345EE00-memory.dmp

Download

memory/3284-52-0x0000000063400000-0x000000006345EE00-memory.dmp

Download

memory/3284-53-0x00000000021E0000-0x00000000021EE000-memory.dmp

Download

memory/3328-55-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3480-15-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/4708-22-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4708-20-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4708-18-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4784-17-0x0000000063400000-0x000000006345EE00-memory.dmp

Download

memory/4784-21-0x0000000063400000-0x000000006345EE00-memory.dmp

Download

memory/4784-13-0x0000000063400000-0x000000006345EE00-memory.dmp

Download

memory/4784-16-0x0000000063450000-0x0000000063451000-memory.dmp

Download