modiloader | e723ee615d7a64e918ab185b645324a0cb1b376302d33b54995b54da39be51f3

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-05-2024 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

autoss.exe
Size

2.1MB
MD5

da4e0703a34085c2fa77d86492273381
SHA1

6905a25afa412c21528fa601c121c957d0436248
SHA256

41064f46efbd85824697f4675ff6d70e9b47107891fcc5a966361deb370a70cf
SHA512

98d339c8e915f8d967641eafc22ee14216a9d5dd61e660d0aba557af622667b52eeacb9d54a043b04bae6079937986d4b7ad219077ceea348de328b6520d6327
SSDEEP

24576:IbYUSrlwjSVB9y81hXlEM2Iu9VYRj/1rRiVzC2:Is3zy4u9WD1twzC

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral15/memory/2240-15-0x0000000000400000-0x0000000000615000-memory.dmp	modiloader_stage2
behavioral15/memory/2240-24-0x0000000000400000-0x0000000000615000-memory.dmp	modiloader_stage2

Modifies registry class 6 IoCs

Processes:

autoss.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	autoss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	autoss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B2178DF1-BDA4-421D-B03E-EA1B3A25F281}	autoss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B2178DF1-BDA4-421D-B03E-EA1B3A25F281}\Info	autoss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B2178DF1-BDA4-421D-B03E-EA1B3A25F281}\Info\Data = 0062d4772462d477b25d8f7834fb180098fad27768fa1800f8f91800aafad27774fb1800cd1ed8773a69440ffeffffff2462d477fc1eee75340000c00d096d77c0fb1800091fee75500100005cfb180064fb18006ce3d37760fb1800020000000000000000000000500100000000000068fa1800340000c0b802000000000101a8f918000000000030fb1800cd1ed877d26f440f000000000000000021106d77acfa1800f87dd47700000000000000000000000000007900d0887e00200000002cfb18001e0023002c00000008fb180032e7d377d0887e00c8877e0001000000c8887e00ecfa180003e0d377c0fb180034fb180000000000c8887e0000fb180088e6d3770000790000000000d0887e0010fb1800eabc43c3e20b000014201208b99faa973cfb18000005d777eabc43c3260c00000eb967faeb50d7c61a000000000000000000000078fb1800000000005cfb18006805d7773c00000000000000000000000000000005000000130000001f00e640ea6c67040500000190fb1800cfa5400088fb1800ba031800b42d02020c12040204322e303077aeee935deb3f1e00000060aa4000ba031800aeee935daeee935dbb32e6400000130014001f00	autoss.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{B2178DF1-BDA4-421D-B03E-EA1B3A25F281}\Info	autoss.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

autoss.exe

description	pid	process
Token: 33	2240	autoss.exe
Token: SeIncBasePriorityPrivilege	2240	autoss.exe
Token: 33	2240	autoss.exe
Token: SeIncBasePriorityPrivilege	2240	autoss.exe
Token: 33	2240	autoss.exe
Token: SeIncBasePriorityPrivilege	2240	autoss.exe
Token: 33	2240	autoss.exe
Token: SeIncBasePriorityPrivilege	2240	autoss.exe

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

autoss.exe

pid process

2240 autoss.exe
2240 autoss.exe
2240 autoss.exe
2240 autoss.exe
2240 autoss.exe
2240 autoss.exe
2240 autoss.exe
2240 autoss.exe
2240 autoss.exe
Suspicious use of SendNotifyMessage 9 IoCs

Processes:

autoss.exe

pid process

2240 autoss.exe
2240 autoss.exe
2240 autoss.exe
2240 autoss.exe
2240 autoss.exe
2240 autoss.exe
2240 autoss.exe
2240 autoss.exe
2240 autoss.exe

pid	process
2240	autoss.exe
2240	autoss.exe
2240	autoss.exe
2240	autoss.exe
2240	autoss.exe
2240	autoss.exe
2240	autoss.exe
2240	autoss.exe
2240	autoss.exe

pid	process
2240	autoss.exe
2240	autoss.exe
2240	autoss.exe
2240	autoss.exe
2240	autoss.exe
2240	autoss.exe
2240	autoss.exe
2240	autoss.exe
2240	autoss.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

autoss.exe

description	pid	process	target process
PID 2240 wrote to memory of 2056	2240	autoss.exe	cmd.exe
PID 2240 wrote to memory of 2056	2240	autoss.exe	cmd.exe
PID 2240 wrote to memory of 2056	2240	autoss.exe	cmd.exe
PID 2240 wrote to memory of 2056	2240	autoss.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\autoss.exe
"C:\Users\Admin\AppData\Local\Temp\autoss.exe"
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C C:\Users\Admin\AppData\Local\Temp\~RomDmp1\RomDump.com > C:\Users\Admin\AppData\Local\Temp\~RomDmp1\Rom.dmp
2⤵
PID:2056

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wake.ini
Filesize
67B

MD5
97bb424f9b87f82837c052ac0492854a

SHA1
5cbda78e812bdae84eb528489e63127e04ae9c59

SHA256
8b844e87344f777a6c6d555484c958c81256fea9f8c4dccb8b7323935eda502c

SHA512
9553cee58331de204feb5b29514952033f582dc433d779b890c70aaf856f50153964da7cc8c3ffef855b0237a50271ef7d14b47db98f1a64a3fa6187f48d33a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\wake.ini
Filesize
53B

MD5
e4f2b39c347c092bb1af852cec8a19af

SHA1
e2e0873d600e7eeacbad5467d66ec0cdd57ec673

SHA256
8ab7a67931e8ab579c5b826ee9fd0a818b52b8330b9766782f8c3deba3b97c5c

SHA512
543dcb794956f848cb0a871b6d10e75042c42d69e8b34e41d7fb2c4c5a425fd66d0524f09b3cae5e10f8703ca76e54cf383114c5ba747fc4c3cf40082248d26f

Download Submit
memory/2240-0-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2240-15-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/2240-17-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2240-24-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads