modiloader | 2ab2f62f9d8a456a6a390d45e877aac2b1122f5b48b15d4e6091524d1163f0ca

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

189189cecc24682dfd4b1e2be32945cc_JaffaCakes118.exe
Size

430KB
MD5

189189cecc24682dfd4b1e2be32945cc
SHA1

f907ffad7bb4083cc8e77c4fa6750a8fc5f34f87
SHA256

2ab2f62f9d8a456a6a390d45e877aac2b1122f5b48b15d4e6091524d1163f0ca
SHA512

d4c73e35f9e082cadd86ed6cf573d16297187fbc390437bb80d809933262b2c21a72926eebb6cc35f02dcc360baabf8dee408c0d2b0d33eafe40d5eda7eb9a95
SSDEEP

12288:MeZ8wPj+dB1/F3Z4mxxzA8a/u62hc8Rqvaj:MenPEQmXzAt/TSc8H

Score

10^/10

modiloader evasion persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

NvCplDaemon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NvCplDaemon.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NvCplDaemon.exe

ModiLoader Second Stage 15 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3184-40-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2
behavioral2/memory/4344-56-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2
behavioral2/memory/4344-59-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2
behavioral2/memory/4344-62-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2
behavioral2/memory/4344-65-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2
behavioral2/memory/4344-68-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2
behavioral2/memory/4344-71-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2
behavioral2/memory/4344-74-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2
behavioral2/memory/4344-77-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2
behavioral2/memory/4344-80-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2
behavioral2/memory/4344-83-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2
behavioral2/memory/4344-86-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2
behavioral2/memory/4344-89-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2
behavioral2/memory/4344-92-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2
behavioral2/memory/4344-95-0x0000000000400000-0x00000000004C0000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

189189cecc24682dfd4b1e2be32945cc_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation 189189cecc24682dfd4b1e2be32945cc_JaffaCakes118.exe
Deletes itself 1 IoCs

Processes:

NvCplDaemon.exe

pid process

4344 NvCplDaemon.exe
Executes dropped EXE 1 IoCs

Processes:

NvCplDaemon.exe

pid process

4344 NvCplDaemon.exe
Loads dropped DLL 4 IoCs

Processes:

NvCplDaemon.exe

pid process

4344 NvCplDaemon.exe
4344 NvCplDaemon.exe
4344 NvCplDaemon.exe
4344 NvCplDaemon.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	189189cecc24682dfd4b1e2be32945cc_JaffaCakes118.exe

pid	process
4344	NvCplDaemon.exe

pid	process
4344	NvCplDaemon.exe

pid	process
4344	NvCplDaemon.exe
4344	NvCplDaemon.exe
4344	NvCplDaemon.exe
4344	NvCplDaemon.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

NvCplDaemon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvCplDaemon = "C:\\Windows\\NvCplDaemon.exe"	NvCplDaemon.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

189189cecc24682dfd4b1e2be32945cc_JaffaCakes118.exeNvCplDaemon.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	189189cecc24682dfd4b1e2be32945cc_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	NvCplDaemon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NvCplDaemon.exe

Drops file in Windows directory 4 IoCs

Processes:

189189cecc24682dfd4b1e2be32945cc_JaffaCakes118.exeNvCplDaemon.exe

description	ioc	process
File created	C:\Windows\NvCplDaemon.exe	189189cecc24682dfd4b1e2be32945cc_JaffaCakes118.exe
File opened for modification	C:\Windows\NvCplDaemon.exe	189189cecc24682dfd4b1e2be32945cc_JaffaCakes118.exe
File created	C:\Windows\ntdtcstp.dll	NvCplDaemon.exe
File created	C:\Windows\cmsetac.dll	NvCplDaemon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

189189cecc24682dfd4b1e2be32945cc_JaffaCakes118.exevssvc.exeNvCplDaemon.exe

description	pid	process
Token: SeDebugPrivilege	3184	189189cecc24682dfd4b1e2be32945cc_JaffaCakes118.exe
Token: SeBackupPrivilege	3028	vssvc.exe
Token: SeRestorePrivilege	3028	vssvc.exe
Token: SeAuditPrivilege	3028	vssvc.exe
Token: SeDebugPrivilege	4344	NvCplDaemon.exe
Token: SeDebugPrivilege	4344	NvCplDaemon.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

NvCplDaemon.exe

pid process

4344 NvCplDaemon.exe
4344 NvCplDaemon.exe

pid	process
4344	NvCplDaemon.exe
4344	NvCplDaemon.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

189189cecc24682dfd4b1e2be32945cc_JaffaCakes118.exe

description	pid	process	target process
PID 3184 wrote to memory of 4344	3184	189189cecc24682dfd4b1e2be32945cc_JaffaCakes118.exe	NvCplDaemon.exe
PID 3184 wrote to memory of 4344	3184	189189cecc24682dfd4b1e2be32945cc_JaffaCakes118.exe	NvCplDaemon.exe
PID 3184 wrote to memory of 4344	3184	189189cecc24682dfd4b1e2be32945cc_JaffaCakes118.exe	NvCplDaemon.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

NvCplDaemon.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NvCplDaemon.exe
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NvCplDaemon.exe

C:\Users\Admin\AppData\Local\Temp\189189cecc24682dfd4b1e2be32945cc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\189189cecc24682dfd4b1e2be32945cc_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184

C:\Windows\NvCplDaemon.exe
"C:\Windows\NvCplDaemon.exe" \melt "C:\Users\Admin\AppData\Local\Temp\189189cecc24682dfd4b1e2be32945cc_JaffaCakes118.exe"
2⤵
- UAC bypass
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4344

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3028

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\NvCplDaemon.exe
Filesize
430KB

MD5
189189cecc24682dfd4b1e2be32945cc

SHA1
f907ffad7bb4083cc8e77c4fa6750a8fc5f34f87

SHA256
2ab2f62f9d8a456a6a390d45e877aac2b1122f5b48b15d4e6091524d1163f0ca

SHA512
d4c73e35f9e082cadd86ed6cf573d16297187fbc390437bb80d809933262b2c21a72926eebb6cc35f02dcc360baabf8dee408c0d2b0d33eafe40d5eda7eb9a95

Download Submit
C:\Windows\cmsetac.dll
Filesize
36KB

MD5
a3cf45bd23b9c513c4a2dabc047f74c6

SHA1
747868f0f322111b81aa5ae9554eacb2ffc87f8e

SHA256
1dcd633f1afb6a78aea3b6525b4903ef76222a6568d25e6c756dd9a27548347a

SHA512
e2038ae9980b697d97fc0c093e6676bbdafa59740cd19e6594811acac2e6e452060cdabaa3d1019cfd79be9608991e7d91371e2d58858a0b84a761f26db8cda5

Download Submit
C:\Windows\ntdtcstp.dll
Filesize
9KB

MD5
8988957d6aa690984f19167377007b8c

SHA1
57dcec51ce851bd9c77a56ced5b087d9e57a3f64

SHA256
81ad8611216205aca94994f370c00cdc99ebeb74252b0aa0916d9832be8c17d5

SHA512
cd47b437b3f1a977047a14c3d5f9177245634fefca000fa67b373220ff0fcb7e7efbd96beb166e6742bd8984144b64b223d9f5744cc89ebeb0faab47879d03bb

Download Submit
memory/3184-0-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/3184-9-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/3184-26-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/3184-28-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/3184-27-0x00000000032E0000-0x00000000032E2000-memory.dmp

Filesize
8KB

Download
memory/3184-25-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/3184-24-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/3184-23-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/3184-22-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/3184-21-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/3184-20-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3184-19-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/3184-18-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/3184-17-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/3184-16-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/3184-15-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/3184-14-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/3184-13-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/3184-12-0x00000000032F0000-0x00000000032F1000-memory.dmp

Filesize
4KB

Download
memory/3184-11-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/3184-10-0x0000000003300000-0x0000000003301000-memory.dmp

Filesize
4KB

Download
memory/3184-8-0x0000000003300000-0x0000000003301000-memory.dmp

Filesize
4KB

Download
memory/3184-7-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/3184-6-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/3184-5-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/3184-4-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/3184-3-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/3184-2-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/3184-1-0x0000000000990000-0x00000000009E4000-memory.dmp

Filesize
336KB

Download
memory/3184-41-0x0000000000990000-0x00000000009E4000-memory.dmp

Filesize
336KB

Download
memory/3184-40-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/4344-42-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/4344-53-0x0000000003B30000-0x0000000003B3F000-memory.dmp

Filesize
60KB

Download
memory/4344-58-0x0000000003B30000-0x0000000003B3F000-memory.dmp

Filesize
60KB

Download
memory/4344-57-0x00000000023F0000-0x00000000023F9000-memory.dmp

Filesize
36KB

Download
memory/4344-56-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/4344-59-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/4344-62-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/4344-65-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/4344-68-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/4344-71-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/4344-74-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/4344-77-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/4344-80-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/4344-83-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/4344-86-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/4344-89-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/4344-92-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/4344-95-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download