Analysis
-
max time kernel
147s -
max time network
131s -
platform
windows7_x64 -
resource
win7-en-20210916 -
submitted
17-09-2021 21:09
Static task
static1
Behavioral task
behavioral1
Sample
2a59d2396654692dc87a81df7554b608.exe
Resource
win7-en-20210916
Behavioral task
behavioral2
Sample
2a59d2396654692dc87a81df7554b608.exe
Resource
win10v20210408
General
-
Target
2a59d2396654692dc87a81df7554b608.exe
-
Size
433KB
-
MD5
2a59d2396654692dc87a81df7554b608
-
SHA1
a545b6bc8ab5afd12feb22686af50f4075fb61cd
-
SHA256
04e98a900ca361b68ebcfbad6453ddc626d93c8afb13916c18dd0e9648187566
-
SHA512
a612f5fe059baf09f6aa30c7a41c9c00d225f326d5d6a10476aa1969c2e0ce3c39986b519ff77be787a61695d71e2fc18766ea9f93509332096c0d7e613cbea8
Malware Config
Extracted
xloader
2.3
b6a4
http://www.helpmovingandstorage.com/b6a4/
gr2future.com
asteroid.finance
skoba-plast.com
rnerfrfw5z3ki.net
thesmartroadtoretirement.com
avisdrummondhomes.com
banban365.net
profesyonelkampcadiri.net
royalloanhs.com
yulujy.com
xn--naqejahan-n3b.com
msalee.net
dollyvee.com
albertagamehawkersclub.com
cbspecialists.com
findingforeverrealty.com
mrtireshop.com
wadamasanari.com
growtechinfo.com
qipai039.com
kdpwelness.com
heonyearthoo.com
comprarmiaspiradora.com
e38.site
aryadesigningstudio.com
wildwestkelly.com
mengzhanxy.com
kedaiherbalalami.com
mygaybookcase.com
meetheveganz.com
42shenmao.com
siimezhebi.com
id-ers.com
cabalzi.com
hellahealthy.life
mastermind-kc.com
erinkiauq.icu
shinebrightjournal.com
adventuresofdatinginnyc.com
kestuf.net
khadarelhodge.com
maximumsale.com
rishitaprabhu.com
dinhvitraitim.com
dalvascleaningservice.com
norfolkveggiebox.com
findsmartvestorpro.com
shuangyashanpower.com
shukujitsu.net
naughty0milf.today
jdjseshop.com
breathlessandinlove.com
abrosnm3.com
candoyuran.com
recargasasec.com
puffycannabis.com
shopnewmills.com
blue-sky-music.com
besthypee.com
idahocommunitynewsnetwork.com
darenscape.com
gamificationbiz.com
avosmains.net
starlangue.com
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/524-56-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2a59d2396654692dc87a81df7554b608.exedescription pid process target process PID 980 set thread context of 524 980 2a59d2396654692dc87a81df7554b608.exe 2a59d2396654692dc87a81df7554b608.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2a59d2396654692dc87a81df7554b608.exepid process 524 2a59d2396654692dc87a81df7554b608.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
2a59d2396654692dc87a81df7554b608.exepid process 980 2a59d2396654692dc87a81df7554b608.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
2a59d2396654692dc87a81df7554b608.exedescription pid process target process PID 980 wrote to memory of 524 980 2a59d2396654692dc87a81df7554b608.exe 2a59d2396654692dc87a81df7554b608.exe PID 980 wrote to memory of 524 980 2a59d2396654692dc87a81df7554b608.exe 2a59d2396654692dc87a81df7554b608.exe PID 980 wrote to memory of 524 980 2a59d2396654692dc87a81df7554b608.exe 2a59d2396654692dc87a81df7554b608.exe PID 980 wrote to memory of 524 980 2a59d2396654692dc87a81df7554b608.exe 2a59d2396654692dc87a81df7554b608.exe PID 980 wrote to memory of 524 980 2a59d2396654692dc87a81df7554b608.exe 2a59d2396654692dc87a81df7554b608.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a59d2396654692dc87a81df7554b608.exe"C:\Users\Admin\AppData\Local\Temp\2a59d2396654692dc87a81df7554b608.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\2a59d2396654692dc87a81df7554b608.exe"C:\Users\Admin\AppData\Local\Temp\2a59d2396654692dc87a81df7554b608.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:524
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/524-55-0x000000000041D0B0-mapping.dmp
-
memory/524-56-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/524-57-0x00000000008D0000-0x0000000000BD3000-memory.dmpFilesize
3.0MB
-
memory/980-53-0x0000000076921000-0x0000000076923000-memory.dmpFilesize
8KB
-
memory/980-54-0x0000000000100000-0x0000000000102000-memory.dmpFilesize
8KB