Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
20-04-2021 12:19
Static task
static1
Behavioral task
behavioral1
Sample
a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe
Resource
win7v20210408
General
-
Target
a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe
-
Size
611KB
-
MD5
a1d6e3ac3ee1adbbc7a16e5f7d7cac1d
-
SHA1
c389f7fe73ba9c75d391c9f9c2bcff87c51556c7
-
SHA256
c076e25acd902f35a52bdb12240494e39df85412b09111e451afdc584487b5df
-
SHA512
d247593dcf889544745ff02599f8094811a83a159c9818c377b00ff39daa68be8125f799d23074b57e2ddfeb878b5d68615e3f258e646164aca98c19dba5807b
Malware Config
Extracted
xloader
2.3
http://www.allindiatrust.com/sbjq/
topbrandslook.xyz
kupilabs.com
cedrick.net
91mh.info
ajoph.net
finishtheverse.com
pondokquranaljariyah.com
happyhoopoe.com
lowcostfooddelivery.com
estudiosvacunacovid19-co.com
iestradanhhome.com
xn--caasymas-e3a.com
shopqls.com
wpnator.com
parentedagency.com
nundmshop.com
lodosmimarlik.com
ccidyy.xyz
bem-vestida.com
smartincomeafrica.com
luckydaysshop.com
spaceorbits.net
mindtattooed.com
pengruncapital.com
colesmxth.com
biyahetours.com
15211avis.com
marshylime.com
cinmax.xyz
marriedtwomusic.com
fakingslatino.com
slotspinbet.com
classicluxuryboats.com
missjenniferteaches.com
minimalismoweb.com
mlblandscaping.co.uk
gzotuo.com
coffeetaste0.com
ylty88.com
437bowlinggreen.com
hinetin.net
umkateknoloji.com
bnsubstock.com
ftxhxx.com
russellandcompanyrealestate.com
hamrocity.com
thenicolehernandez.com
afspinc.com
artlyusa.com
cryptocurrencydefi.com
betteryouwiththeoils.com
energetichealingsystem.com
lucaslh.com
undeadvengeance.com
count230.com
landerauto.com
sxqxga.com
assetsking.com
prosperedfreelancing.com
bee-yondimagination.com
androidwerks.com
securitymanagementcfo.com
iwouldbetonthat.com
appstore-verify-appleid.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1428-68-0x000000000041D060-mapping.dmp xloader behavioral1/memory/1428-67-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exedescription pid process target process PID 756 set thread context of 1428 756 a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exea1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exepid process 756 a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe 756 a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe 1428 a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exedescription pid process Token: SeDebugPrivilege 756 a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exedescription pid process target process PID 756 wrote to memory of 1428 756 a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe PID 756 wrote to memory of 1428 756 a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe PID 756 wrote to memory of 1428 756 a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe PID 756 wrote to memory of 1428 756 a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe PID 756 wrote to memory of 1428 756 a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe PID 756 wrote to memory of 1428 756 a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe PID 756 wrote to memory of 1428 756 a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe"C:\Users\Admin\AppData\Local\Temp\a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe"C:\Users\Admin\AppData\Local\Temp\a1d6e3ac3ee1adbbc7a16e5f7d7cac1d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/756-60-0x0000000000980000-0x0000000000981000-memory.dmpFilesize
4KB
-
memory/756-62-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/756-63-0x0000000000560000-0x0000000000569000-memory.dmpFilesize
36KB
-
memory/756-64-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/756-65-0x00000000051A0000-0x0000000005222000-memory.dmpFilesize
520KB
-
memory/756-66-0x00000000020B0000-0x00000000020ED000-memory.dmpFilesize
244KB
-
memory/1428-68-0x000000000041D060-mapping.dmp
-
memory/1428-67-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1428-70-0x0000000000A20000-0x0000000000D23000-memory.dmpFilesize
3.0MB