Analysis
-
max time kernel
85s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en -
submitted
18-09-2021 19:37
Static task
static1
Behavioral task
behavioral1
Sample
2a69371ccb46bbc07aebe99359fd69b9.exe
Resource
win7v20210408
General
-
Target
2a69371ccb46bbc07aebe99359fd69b9.exe
-
Size
477KB
-
MD5
2a69371ccb46bbc07aebe99359fd69b9
-
SHA1
8be1b2e74bb857b130222bf2604fa79952792034
-
SHA256
06db28157cbf8afaef9fada2db963f0a1f81a266512c748dc6ea86d371036900
-
SHA512
fd8089141d3a926e197c3aee2ed4b44798591b0311a5973de3eafc88c1837d9620c413a873c27c579ce133f299926026938601b0784dd50588ca02cf123835af
Malware Config
Extracted
xloader
2.4
uytf
http://www.fasilitatortoefl.com/uytf/
estherestates.online
babyballetwigan.com
ignorantrough.xyz
moominmamalog.com
pasticcerialemmi.com
orangstyle.com
oldwaterfordfarm.com
aiiqiuwnsas.com
youindependents.com
runbank.net
phytolipshine.com
almedmedicalcenter.com
czxzsa.com
yummyblockparty.com
gadgetinfo.info
cloudfolderplayer.com
chowding.com
xn--tarzmbu-ufb.com
danielaasab.com
dreampropertiesluxury.com
itsready.support
freepoeople.com
richesosity.online
covidbrainfogsyndrome.com
hide.osaka
fitotec.net
cdfdwj.com
vjr.realestate
knowit.today
sellhomefastinorlando.com
permacademy.net
andhraadvocates.com
rochainrevsry.xyz
casino-virtuali.net
liptondesignstudio.xyz
keyinternationals.com
gamifibase.com
atjehtimur.com
hobonickelsvillarrubia.com
johnharrisagent.com
preabsorb.xyz
likevietsub38.com
getrichandsavetheworld.com
livelife2dance.com
juesparza.com
buffalocreekdesign.com
diegos.xyz
covidforensicaudit.com
popitperu.com
gczvahqeg.site
aspireship.tech
freedomforfarmedrabbits.online
pasalsacongress.com
custommetalimagery.photography
managementcoachinginc.com
hxysjkj.com
trusticoin.biz
wireconnectaz.tech
yoiseikatsu.net
slggroups.com
curiousmug.com
svetarielt.site
nongormart.com
btt5204.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3920-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3920-126-0x000000000041D520-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2a69371ccb46bbc07aebe99359fd69b9.exedescription pid process target process PID 3556 set thread context of 3920 3556 2a69371ccb46bbc07aebe99359fd69b9.exe 2a69371ccb46bbc07aebe99359fd69b9.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2a69371ccb46bbc07aebe99359fd69b9.exepid process 3920 2a69371ccb46bbc07aebe99359fd69b9.exe 3920 2a69371ccb46bbc07aebe99359fd69b9.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
2a69371ccb46bbc07aebe99359fd69b9.exedescription pid process target process PID 3556 wrote to memory of 3920 3556 2a69371ccb46bbc07aebe99359fd69b9.exe 2a69371ccb46bbc07aebe99359fd69b9.exe PID 3556 wrote to memory of 3920 3556 2a69371ccb46bbc07aebe99359fd69b9.exe 2a69371ccb46bbc07aebe99359fd69b9.exe PID 3556 wrote to memory of 3920 3556 2a69371ccb46bbc07aebe99359fd69b9.exe 2a69371ccb46bbc07aebe99359fd69b9.exe PID 3556 wrote to memory of 3920 3556 2a69371ccb46bbc07aebe99359fd69b9.exe 2a69371ccb46bbc07aebe99359fd69b9.exe PID 3556 wrote to memory of 3920 3556 2a69371ccb46bbc07aebe99359fd69b9.exe 2a69371ccb46bbc07aebe99359fd69b9.exe PID 3556 wrote to memory of 3920 3556 2a69371ccb46bbc07aebe99359fd69b9.exe 2a69371ccb46bbc07aebe99359fd69b9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a69371ccb46bbc07aebe99359fd69b9.exe"C:\Users\Admin\AppData\Local\Temp\2a69371ccb46bbc07aebe99359fd69b9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2a69371ccb46bbc07aebe99359fd69b9.exe"C:\Users\Admin\AppData\Local\Temp\2a69371ccb46bbc07aebe99359fd69b9.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3556-115-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/3556-117-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/3556-118-0x0000000004AD0000-0x0000000004AD1000-memory.dmpFilesize
4KB
-
memory/3556-119-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB
-
memory/3556-120-0x0000000004A30000-0x0000000004F2E000-memory.dmpFilesize
5.0MB
-
memory/3556-121-0x0000000004CD0000-0x0000000004CD7000-memory.dmpFilesize
28KB
-
memory/3556-122-0x0000000006E30000-0x0000000006E31000-memory.dmpFilesize
4KB
-
memory/3556-123-0x0000000007260000-0x00000000072C0000-memory.dmpFilesize
384KB
-
memory/3556-124-0x0000000009A30000-0x0000000009A5B000-memory.dmpFilesize
172KB
-
memory/3920-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3920-126-0x000000000041D520-mapping.dmp
-
memory/3920-127-0x00000000011C0000-0x00000000014E0000-memory.dmpFilesize
3.1MB