modiloader | e723ee615d7a64e918ab185b645324a0cb1b376302d33b54995b54da39be51f3 | Triage

Analysis

max time kernel
135s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 20:31

Sharing

Report Analysis Logs

General

Target

AutoPower.exe
Size

526KB
MD5

0ad902046991b2a1f566247c9276c665
SHA1

5c1e2be6f2ba40ec8dd935b851a4e74a8995b914
SHA256

ae5fdb6c9dece79b53d2140015d49c2063dce3f91194780c5af46ac5bd32ebb7
SHA512

e05d1bbaf2533cd77e5cba96df3bb54b4dee716a94ce4be2ce9f744a8139248058ea4303de3fa2e7a4d049a35087766d8f524e1f5f62818bda17bb82ce77df7f
SSDEEP

12288:Kc2PpRw2RpYfoxr/a7/PbmqPXNwrTFAp4oUHIXt:SxRDYfoxDIBVwrTO5

Score

10^/10

modiloader trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

Processes:

resource	yara_rule
behavioral8/memory/3080-1-0x0000000000400000-0x000000000048A000-memory.dmp	modiloader_stage2

Modifies registry class 7 IoCs

Processes:

AutoPower.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B2178DF1-BDA4-421D-B03E-EA1B3A25F281}\Info\Data = 001e9d760000000000000000090000009b4ca87618245200090000002c2b0477906f0577083e5200101e9d76feffff00f0fa19001855a576340000c000000000b4fb19002555a5764cfb1900000000000c00000054fb190000000000e40100000200000058001900000000000000000058fa19000000000008bf43c3e20b0000142012085ea1aa97a4fa19000c5c0200086f6704b8fa190001000000a4fa19003c0000002baada014b4b568600000000086f6704b8fa190004000000a7010000ecfa1900c6cd027748fb000098fb19002c340a02e8070500130014001f001b00f00100004b4b56862baada019b4ca8760000000000000000000000000000000000000000000000002cfb1900b7e5a67608fb190014fb190048fb190090210a0205e6a6764b4b56862baada012000fe7fe8070500130014001f001b00f0010000ac8d53c40000000084fb190051e5a67648fb190090210a022c340a022c340a0200000000000000000500000013004ac41f00e640086f67040500000184fb1900439a40007cfb1900f001190090210a022c340a0204322e3030618d16a15deb3f1e000000f09d4000f00119008d16a15d8d16a15dbb32e6400000130014001f00	AutoPower.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B2178DF1-BDA4-421D-B03E-EA1B3A25F281}\Info\Data = 00790577b069540000005200b0695400000000000200000000000200c0010200080014006400000000000000a8b154002d000000000000003b002d00b0665400b069540098b1540000005200080014007cfd1900163c0177000000000000000000000000b00054000000000004000000209db2768091b276784f0f77b06654000400000011840077a8fe1900000000003000000001000000e40100006884007790fd190004170a025c190a0204170a020000000054e741000000000098000200784f0f7700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c4fe19007cfe19009c1b0a02881b0a02741b0a02bc0000009c1b0a02881b0a02741b0a02bc000000a0fe190045244000cc0546004d2440001c0a0a025c190a02ffffffff0000000004322e3030274000781b0a021e00000050210a021c0a0a02010000008d16a15dbb32e6402c340a0201000000	AutoPower.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{B2178DF1-BDA4-421D-B03E-EA1B3A25F281}\Info	AutoPower.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	AutoPower.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	AutoPower.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B2178DF1-BDA4-421D-B03E-EA1B3A25F281}	AutoPower.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B2178DF1-BDA4-421D-B03E-EA1B3A25F281}\Info	AutoPower.exe

C:\Users\Admin\AppData\Local\Temp\AutoPower.exe
"C:\Users\Admin\AppData\Local\Temp\AutoPower.exe"
1⤵
- Modifies registry class
PID:3080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3080-0-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/3080-1-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download