Analysis
-
max time kernel
96s -
max time network
34s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
17-09-2021 20:57
Static task
static1
Behavioral task
behavioral1
Sample
866d1aeb69daac5e6e4dda938edf8d26.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
866d1aeb69daac5e6e4dda938edf8d26.exe
Resource
win10v20210408
General
-
Target
866d1aeb69daac5e6e4dda938edf8d26.exe
-
Size
430KB
-
MD5
866d1aeb69daac5e6e4dda938edf8d26
-
SHA1
184f3ae0508d5004a9e3fe981cbc830092d41ed7
-
SHA256
a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564
-
SHA512
e488ee1b612c683c72c9ce7d33727d1f6daa6f1bdb599b9f77fd2cf6f0b7122d650a4347bfb836bf4b5e111c92057ecfb91fd517821c32cf7b1fc246ec8bfcee
Malware Config
Extracted
xloader
2.3
b6a4
http://www.helpmovingandstorage.com/b6a4/
gr2future.com
asteroid.finance
skoba-plast.com
rnerfrfw5z3ki.net
thesmartroadtoretirement.com
avisdrummondhomes.com
banban365.net
profesyonelkampcadiri.net
royalloanhs.com
yulujy.com
xn--naqejahan-n3b.com
msalee.net
dollyvee.com
albertagamehawkersclub.com
cbspecialists.com
findingforeverrealty.com
mrtireshop.com
wadamasanari.com
growtechinfo.com
qipai039.com
kdpwelness.com
heonyearthoo.com
comprarmiaspiradora.com
e38.site
aryadesigningstudio.com
wildwestkelly.com
mengzhanxy.com
kedaiherbalalami.com
mygaybookcase.com
meetheveganz.com
42shenmao.com
siimezhebi.com
id-ers.com
cabalzi.com
hellahealthy.life
mastermind-kc.com
erinkiauq.icu
shinebrightjournal.com
adventuresofdatinginnyc.com
kestuf.net
khadarelhodge.com
maximumsale.com
rishitaprabhu.com
dinhvitraitim.com
dalvascleaningservice.com
norfolkveggiebox.com
findsmartvestorpro.com
shuangyashanpower.com
shukujitsu.net
naughty0milf.today
jdjseshop.com
breathlessandinlove.com
abrosnm3.com
candoyuran.com
recargasasec.com
puffycannabis.com
shopnewmills.com
blue-sky-music.com
besthypee.com
idahocommunitynewsnetwork.com
darenscape.com
gamificationbiz.com
avosmains.net
starlangue.com
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/268-61-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
866d1aeb69daac5e6e4dda938edf8d26.exedescription pid process target process PID 2044 set thread context of 268 2044 866d1aeb69daac5e6e4dda938edf8d26.exe 866d1aeb69daac5e6e4dda938edf8d26.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
866d1aeb69daac5e6e4dda938edf8d26.exepid process 268 866d1aeb69daac5e6e4dda938edf8d26.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
866d1aeb69daac5e6e4dda938edf8d26.exepid process 2044 866d1aeb69daac5e6e4dda938edf8d26.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
866d1aeb69daac5e6e4dda938edf8d26.exedescription pid process target process PID 2044 wrote to memory of 268 2044 866d1aeb69daac5e6e4dda938edf8d26.exe 866d1aeb69daac5e6e4dda938edf8d26.exe PID 2044 wrote to memory of 268 2044 866d1aeb69daac5e6e4dda938edf8d26.exe 866d1aeb69daac5e6e4dda938edf8d26.exe PID 2044 wrote to memory of 268 2044 866d1aeb69daac5e6e4dda938edf8d26.exe 866d1aeb69daac5e6e4dda938edf8d26.exe PID 2044 wrote to memory of 268 2044 866d1aeb69daac5e6e4dda938edf8d26.exe 866d1aeb69daac5e6e4dda938edf8d26.exe PID 2044 wrote to memory of 268 2044 866d1aeb69daac5e6e4dda938edf8d26.exe 866d1aeb69daac5e6e4dda938edf8d26.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\866d1aeb69daac5e6e4dda938edf8d26.exe"C:\Users\Admin\AppData\Local\Temp\866d1aeb69daac5e6e4dda938edf8d26.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\866d1aeb69daac5e6e4dda938edf8d26.exe"C:\Users\Admin\AppData\Local\Temp\866d1aeb69daac5e6e4dda938edf8d26.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:268
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-59-0x000000000041D0B0-mapping.dmp
-
memory/268-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/268-62-0x0000000000C70000-0x0000000000F73000-memory.dmpFilesize
3.0MB
-
memory/2044-60-0x0000000000290000-0x0000000000292000-memory.dmpFilesize
8KB