Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-01-2025 11:22

General

  • Target

    AIPR.exe

  • Size

    619KB

  • MD5

    fa2cd2d664fe3f39f906c1a08c39d2f0

  • SHA1

    dc420b5fe928fc50ce40700c013c72b2be4b1eb6

  • SHA256

    6c69521f736b5fbe7b61dafd872eb7eef16b47e07c7ac2953eaa098ed02ebdc8

  • SHA512

    20cb3e3f1fce0c63b7c5d2a23fa0f9f9f58f0d599f14ee3e6c934f54b32e61fafd5063f2f7473e07e3c2d2bdecbdd54bfbfca6731bb22386293837bb732ba400

  • SSDEEP

    12288:ByQo2YxUATJONqzhzlKQDL6PeAJo7qDhVZTZ9/+Ac+utTrO40Xy400:4rJOkz1DqfJo7QVZN9/CJtXO4i00

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modiloader family
  • ModiLoader First Stage 15 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AIPR.exe
    "C:\Users\Admin\AppData\Local\Temp\AIPR.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:2524

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2524-0-0x0000000000400000-0x000000000058C000-memory.dmp

    Filesize

    1.5MB

  • memory/2524-1-0x0000000002370000-0x00000000023A2000-memory.dmp

    Filesize

    200KB

  • memory/2524-8-0x00000000024B0000-0x00000000024B1000-memory.dmp

    Filesize

    4KB

  • memory/2524-7-0x00000000024F0000-0x00000000024F1000-memory.dmp

    Filesize

    4KB

  • memory/2524-6-0x0000000002500000-0x0000000002501000-memory.dmp

    Filesize

    4KB

  • memory/2524-5-0x0000000002510000-0x0000000002511000-memory.dmp

    Filesize

    4KB

  • memory/2524-4-0x0000000000700000-0x0000000000701000-memory.dmp

    Filesize

    4KB

  • memory/2524-3-0x0000000002300000-0x0000000002301000-memory.dmp

    Filesize

    4KB

  • memory/2524-2-0x0000000002540000-0x0000000002541000-memory.dmp

    Filesize

    4KB

  • memory/2524-9-0x00000000024E0000-0x00000000024E1000-memory.dmp

    Filesize

    4KB

  • memory/2524-11-0x00000000025A0000-0x00000000025A2000-memory.dmp

    Filesize

    8KB

  • memory/2524-10-0x0000000002560000-0x0000000002561000-memory.dmp

    Filesize

    4KB

  • memory/2524-13-0x00000000025B0000-0x00000000025B1000-memory.dmp

    Filesize

    4KB

  • memory/2524-26-0x00000000026D0000-0x00000000026D1000-memory.dmp

    Filesize

    4KB

  • memory/2524-25-0x00000000026B0000-0x00000000026B1000-memory.dmp

    Filesize

    4KB

  • memory/2524-24-0x00000000026A0000-0x00000000026A1000-memory.dmp

    Filesize

    4KB

  • memory/2524-23-0x0000000002670000-0x0000000002671000-memory.dmp

    Filesize

    4KB

  • memory/2524-22-0x0000000002650000-0x0000000002651000-memory.dmp

    Filesize

    4KB

  • memory/2524-21-0x0000000002660000-0x0000000002661000-memory.dmp

    Filesize

    4KB

  • memory/2524-20-0x0000000002630000-0x0000000002631000-memory.dmp

    Filesize

    4KB

  • memory/2524-19-0x0000000002610000-0x0000000002611000-memory.dmp

    Filesize

    4KB

  • memory/2524-18-0x0000000002620000-0x0000000002621000-memory.dmp

    Filesize

    4KB

  • memory/2524-17-0x00000000025F0000-0x00000000025F1000-memory.dmp

    Filesize

    4KB

  • memory/2524-16-0x0000000002600000-0x0000000002601000-memory.dmp

    Filesize

    4KB

  • memory/2524-15-0x00000000025C0000-0x00000000025C1000-memory.dmp

    Filesize

    4KB

  • memory/2524-14-0x0000000002570000-0x0000000002571000-memory.dmp

    Filesize

    4KB

  • memory/2524-12-0x0000000002590000-0x0000000002591000-memory.dmp

    Filesize

    4KB

  • memory/2524-27-0x0000000000400000-0x000000000058C000-memory.dmp

    Filesize

    1.5MB

  • memory/2524-29-0x0000000002710000-0x0000000002711000-memory.dmp

    Filesize

    4KB

  • memory/2524-41-0x0000000002920000-0x0000000002921000-memory.dmp

    Filesize

    4KB

  • memory/2524-55-0x00000000026E0000-0x00000000026E1000-memory.dmp

    Filesize

    4KB

  • memory/2524-54-0x00000000026C0000-0x00000000026C1000-memory.dmp

    Filesize

    4KB

  • memory/2524-53-0x0000000002690000-0x0000000002691000-memory.dmp

    Filesize

    4KB

  • memory/2524-52-0x0000000002680000-0x0000000002681000-memory.dmp

    Filesize

    4KB

  • memory/2524-70-0x00000000032E0000-0x00000000032E1000-memory.dmp

    Filesize

    4KB

  • memory/2524-69-0x0000000002B60000-0x0000000002B61000-memory.dmp

    Filesize

    4KB

  • memory/2524-68-0x0000000002B40000-0x0000000002B41000-memory.dmp

    Filesize

    4KB

  • memory/2524-67-0x00000000032D0000-0x00000000032D1000-memory.dmp

    Filesize

    4KB

  • memory/2524-66-0x0000000002B50000-0x0000000002B51000-memory.dmp

    Filesize

    4KB

  • memory/2524-65-0x0000000002B30000-0x0000000002B31000-memory.dmp

    Filesize

    4KB

  • memory/2524-64-0x0000000002B20000-0x0000000002B21000-memory.dmp

    Filesize

    4KB

  • memory/2524-63-0x0000000002B00000-0x0000000002B01000-memory.dmp

    Filesize

    4KB

  • memory/2524-62-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

    Filesize

    4KB

  • memory/2524-61-0x00000000028A0000-0x00000000028A1000-memory.dmp

    Filesize

    4KB

  • memory/2524-60-0x0000000002880000-0x0000000002881000-memory.dmp

    Filesize

    4KB

  • memory/2524-59-0x0000000002760000-0x0000000002761000-memory.dmp

    Filesize

    4KB

  • memory/2524-58-0x0000000002740000-0x0000000002741000-memory.dmp

    Filesize

    4KB

  • memory/2524-57-0x0000000002720000-0x0000000002721000-memory.dmp

    Filesize

    4KB

  • memory/2524-56-0x0000000002700000-0x0000000002701000-memory.dmp

    Filesize

    4KB

  • memory/2524-51-0x0000000002640000-0x0000000002641000-memory.dmp

    Filesize

    4KB

  • memory/2524-50-0x0000000002580000-0x0000000002581000-memory.dmp

    Filesize

    4KB

  • memory/2524-49-0x0000000002B10000-0x0000000002B11000-memory.dmp

    Filesize

    4KB

  • memory/2524-48-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

    Filesize

    4KB

  • memory/2524-47-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

    Filesize

    4KB

  • memory/2524-46-0x0000000002A90000-0x0000000002A91000-memory.dmp

    Filesize

    4KB

  • memory/2524-45-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

    Filesize

    4KB

  • memory/2524-44-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

    Filesize

    4KB

  • memory/2524-43-0x0000000002A70000-0x0000000002A71000-memory.dmp

    Filesize

    4KB

  • memory/2524-42-0x0000000002A80000-0x0000000002A81000-memory.dmp

    Filesize

    4KB

  • memory/2524-40-0x0000000002930000-0x0000000002931000-memory.dmp

    Filesize

    4KB

  • memory/2524-39-0x0000000002900000-0x0000000002901000-memory.dmp

    Filesize

    4KB

  • memory/2524-38-0x0000000002910000-0x0000000002911000-memory.dmp

    Filesize

    4KB

  • memory/2524-37-0x00000000028E0000-0x00000000028E1000-memory.dmp

    Filesize

    4KB

  • memory/2524-36-0x00000000028F0000-0x00000000028F1000-memory.dmp

    Filesize

    4KB

  • memory/2524-35-0x00000000028B0000-0x00000000028B1000-memory.dmp

    Filesize

    4KB

  • memory/2524-34-0x00000000028C0000-0x00000000028C1000-memory.dmp

    Filesize

    4KB

  • memory/2524-33-0x0000000002890000-0x0000000002891000-memory.dmp

    Filesize

    4KB

  • memory/2524-32-0x0000000002870000-0x0000000002871000-memory.dmp

    Filesize

    4KB

  • memory/2524-31-0x0000000002750000-0x0000000002751000-memory.dmp

    Filesize

    4KB

  • memory/2524-30-0x0000000002730000-0x0000000002731000-memory.dmp

    Filesize

    4KB

  • memory/2524-28-0x00000000026F0000-0x00000000026F1000-memory.dmp

    Filesize

    4KB

  • memory/2524-75-0x0000000002370000-0x00000000023A2000-memory.dmp

    Filesize

    200KB

  • memory/2524-74-0x0000000004880000-0x0000000004881000-memory.dmp

    Filesize

    4KB

  • memory/2524-73-0x0000000004890000-0x0000000004891000-memory.dmp

    Filesize

    4KB

  • memory/2524-72-0x0000000004860000-0x0000000004861000-memory.dmp

    Filesize

    4KB

  • memory/2524-71-0x0000000004870000-0x0000000004871000-memory.dmp

    Filesize

    4KB

  • memory/2524-76-0x0000000002A90000-0x0000000002A91000-memory.dmp

    Filesize

    4KB

  • memory/2524-77-0x0000000000400000-0x000000000058C000-memory.dmp

    Filesize

    1.5MB

  • memory/2524-78-0x0000000000400000-0x000000000058C000-memory.dmp

    Filesize

    1.5MB

  • memory/2524-79-0x0000000000400000-0x000000000058C000-memory.dmp

    Filesize

    1.5MB

  • memory/2524-80-0x0000000000400000-0x000000000058C000-memory.dmp

    Filesize

    1.5MB

  • memory/2524-81-0x0000000000400000-0x000000000058C000-memory.dmp

    Filesize

    1.5MB

  • memory/2524-82-0x0000000000400000-0x000000000058C000-memory.dmp

    Filesize

    1.5MB

  • memory/2524-83-0x0000000000400000-0x000000000058C000-memory.dmp

    Filesize

    1.5MB

  • memory/2524-84-0x0000000000400000-0x000000000058C000-memory.dmp

    Filesize

    1.5MB

  • memory/2524-85-0x0000000000400000-0x000000000058C000-memory.dmp

    Filesize

    1.5MB

  • memory/2524-86-0x0000000000400000-0x000000000058C000-memory.dmp

    Filesize

    1.5MB

  • memory/2524-87-0x0000000000400000-0x000000000058C000-memory.dmp

    Filesize

    1.5MB

  • memory/2524-88-0x0000000000400000-0x000000000058C000-memory.dmp

    Filesize

    1.5MB

  • memory/2524-89-0x0000000000400000-0x000000000058C000-memory.dmp

    Filesize

    1.5MB

  • memory/2524-90-0x0000000000400000-0x000000000058C000-memory.dmp

    Filesize

    1.5MB