Analysis
-
max time kernel
46s -
max time network
18s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
06-05-2021 09:01
Static task
static1
Behavioral task
behavioral1
Sample
76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe
Resource
win7v20210408
General
-
Target
76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe
-
Size
920KB
-
MD5
e9777bb4745f38009a1d806392a437e5
-
SHA1
76ffc32ba98dd84e396af77ad4311d99b3a1bbb0
-
SHA256
eb8c5fa3da30f5d972e7d30767099990aadce5af9e046a2765b0c64222eab118
-
SHA512
794f80a25ae343075421e2d6a030d3a30ef0f2790649fad1c7fc80b31b4ce9d755dfe10634e0d28a684f39d2cffec0c8e7c17d18547df88335ef2d5c2de29f0f
Malware Config
Extracted
xloader
2.3
http://www.asconstructionin.com/m3rc/
manonkelley.com
prosperouspromises.com
biglebowlski.com
zhenyash.com
wayinfinite.com
vaginalmedicine.com
garnogroup.com
6-8-8-8-8.website
universtal.com
gillet.pro
hwrfxkna.com
unapersonaestabien.com
organicdiehards.com
santini7.com
salt9pepper.com
ericasorganiclife.com
vipgifts.online
mariozumbo.com
genetikfatura.com
heypapabear.com
saniorsterimist.com
the-bold-type.com
maxitoto.com
bluemanmoon.com
providenceoffices.com
jimsklena.com
thefritzserpong.com
qlmstore.com
thetipsytwo.com
cunerier.com
seniorliving100ig.com
danuvia.net
thegijofficial.com
nanogentherapeutics.com
paradajaime.com
nononenseforex.com
hsrinspection.com
labarberiadesamu.com
viviangee.net
shhhapparel.com
100hoodia.com
drlisatharler.com
kefeiping.com
rsw111004.com
irisxorose.com
arabacamfilmi.com
iconchen.com
dhinchakk.com
monitoryourproperty.com
justinforga.com
api-pay-app.com
siplamedia.com
voltageweldingmasks.com
dirtylyxx.com
thelashingladybug.com
cageusa.com
avaatraelegant.com
faydety.info
doggyfacemask.com
virtualtoursthailand.com
northtlc.com
3911599.com
freelancer.wales
gudamma.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/520-66-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/520-67-0x000000000041D030-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exedescription pid process target process PID 1632 set thread context of 520 1632 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exepid process 1632 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe 1632 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe 520 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exedescription pid process Token: SeDebugPrivilege 1632 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exedescription pid process target process PID 1632 wrote to memory of 520 1632 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe PID 1632 wrote to memory of 520 1632 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe PID 1632 wrote to memory of 520 1632 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe PID 1632 wrote to memory of 520 1632 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe PID 1632 wrote to memory of 520 1632 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe PID 1632 wrote to memory of 520 1632 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe PID 1632 wrote to memory of 520 1632 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe 76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe"C:\Users\Admin\AppData\Local\Temp\76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\76ffc32ba98dd84e396af77ad4311d99b3a1bbb0.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/520-66-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/520-67-0x000000000041D030-mapping.dmp
-
memory/520-69-0x00000000009E0000-0x0000000000CE3000-memory.dmpFilesize
3.0MB
-
memory/1632-60-0x00000000013C0000-0x00000000013C1000-memory.dmpFilesize
4KB
-
memory/1632-62-0x0000000006ED0000-0x0000000006ED1000-memory.dmpFilesize
4KB
-
memory/1632-63-0x0000000000250000-0x000000000025E000-memory.dmpFilesize
56KB
-
memory/1632-64-0x0000000005100000-0x0000000005190000-memory.dmpFilesize
576KB
-
memory/1632-65-0x0000000001310000-0x0000000001351000-memory.dmpFilesize
260KB