modiloader | e723ee615d7a64e918ab185b645324a0cb1b376302d33b54995b54da39be51f3 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-05-2024 20:31

Sharing

Report Analysis Logs

General

Target

AutoPower.exe
Size

526KB
MD5

0ad902046991b2a1f566247c9276c665
SHA1

5c1e2be6f2ba40ec8dd935b851a4e74a8995b914
SHA256

ae5fdb6c9dece79b53d2140015d49c2063dce3f91194780c5af46ac5bd32ebb7
SHA512

e05d1bbaf2533cd77e5cba96df3bb54b4dee716a94ce4be2ce9f744a8139248058ea4303de3fa2e7a4d049a35087766d8f524e1f5f62818bda17bb82ce77df7f
SSDEEP

12288:Kc2PpRw2RpYfoxr/a7/PbmqPXNwrTFAp4oUHIXt:SxRDYfoxDIBVwrTO5

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral7/memory/1620-1-0x0000000000400000-0x000000000048A000-memory.dmp	modiloader_stage2

Modifies registry class 7 IoCs

Processes:

AutoPower.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B2178DF1-BDA4-421D-B03E-EA1B3A25F281}	AutoPower.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B2178DF1-BDA4-421D-B03E-EA1B3A25F281}\Info	AutoPower.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B2178DF1-BDA4-421D-B03E-EA1B3A25F281}\Info\Data = 00621477246214774cd54f7840fb180098fa127774fa180004fa1800aafa127780fb1800cd1e1877c8e1440ffeffffff24621477fc1ed474340000c00d096475ccfb1800091fd474c800000068fb180070fb18006ce313776cfb1800020000000000000000000000c80000000000000074fa1800340000c058012f0000000000b02e2f00000000000800180875006e0088392f00000000005c00520045004700490053005400520059005c004d0041000000000000005d00486d610053006f00660074001c002900280000005c0043004c00410053005300106c610001000000406d6100f8fa180003e01377ccfb180040fb180000000000406d61000cfb180088e6137700005d0000000000486d61001cfb180049a843c3e20b000014201208b38faa9748fb18000005177749a843c3260c00000eb967faeb50d7c61a000000000000000000000084fb18000000000068fb1800680517773c00000000000000000000000000000005000000130000001f00e64049586704050000019cfb1800439a400094fb1800a1021800ac2149004834490004322e303094b0bf135deb3f1e000000f09d4000a1021800b1bf135db1bf135dbb32e6400000130014001f00	AutoPower.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B2178DF1-BDA4-421D-B03E-EA1B3A25F281}\Info\Data = 000000000000000000fe180064fd18001f6214772462147704d24f7800fe180000000000100000003cfd180060fe180000005d0000fd6100000000000300000374fd180018fd6100f8df6100c4005d001800000000005d002000000000fd610074fe18009e00147738015d007a38147714d14f780000000000005d0008fd61003381147738015d000000ed0100ef610026e0137727b7d574f8df610050015d0053004d002017490078194900201749000000000054e7410000000006a0b65f7506000006050000000000000070fe18000300000000ef6100050000000100000000000000a20100a30500000000000000d83262000000000008fd610000000000000000000000000050015d009fd704020000000008fd6100f8df61009091e082050000000000000099610001000000002800000030fe010194fd1800ccfe1800ccfe1800cd1e187720e7440ffeffffff7a381477c4e14400c4e14400941b490001000000b81b4900a41b4900bc000000901b4900b8fe180045244000cc0546004d244000c4e14400941b4900781949007819490004322e3030ffffff781949001e0000007021490020ff180001000000b1bf135dbb32e6404834490001000000	AutoPower.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{B2178DF1-BDA4-421D-B03E-EA1B3A25F281}\Info	AutoPower.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	AutoPower.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	AutoPower.exe

C:\Users\Admin\AppData\Local\Temp\AutoPower.exe
"C:\Users\Admin\AppData\Local\Temp\AutoPower.exe"
1⤵
- Modifies registry class
PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1620-1-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download