Analysis
-
max time kernel
107s -
max time network
109s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
21-09-2021 14:10
Static task
static1
Behavioral task
behavioral1
Sample
f92898079644c77d76a03ad969332f03.exe
Resource
win7v20210408
General
-
Target
f92898079644c77d76a03ad969332f03.exe
-
Size
579KB
-
MD5
f92898079644c77d76a03ad969332f03
-
SHA1
4dfda3116b95639ce0e6afd68a433f12262e2617
-
SHA256
e911d332af82b2e6fe66b7d2df23b5a9ba0443ea8f83500ae17c6af1f65d401b
-
SHA512
cc514da892c3bba8b868279d7b1fc06d158662066130cddf67d5b753a7dc20789a31168b7a4a485f49b115f29081d9e396446bbb6325fde7ea7cf3e88f449663
Malware Config
Extracted
xloader
2.4
uytf
http://www.fasilitatortoefl.com/uytf/
estherestates.online
babyballetwigan.com
ignorantrough.xyz
moominmamalog.com
pasticcerialemmi.com
orangstyle.com
oldwaterfordfarm.com
aiiqiuwnsas.com
youindependents.com
runbank.net
phytolipshine.com
almedmedicalcenter.com
czxzsa.com
yummyblockparty.com
gadgetinfo.info
cloudfolderplayer.com
chowding.com
xn--tarzmbu-ufb.com
danielaasab.com
dreampropertiesluxury.com
itsready.support
freepoeople.com
richesosity.online
covidbrainfogsyndrome.com
hide.osaka
fitotec.net
cdfdwj.com
vjr.realestate
knowit.today
sellhomefastinorlando.com
permacademy.net
andhraadvocates.com
rochainrevsry.xyz
casino-virtuali.net
liptondesignstudio.xyz
keyinternationals.com
gamifibase.com
atjehtimur.com
hobonickelsvillarrubia.com
johnharrisagent.com
preabsorb.xyz
likevietsub38.com
getrichandsavetheworld.com
livelife2dance.com
juesparza.com
buffalocreekdesign.com
diegos.xyz
covidforensicaudit.com
popitperu.com
gczvahqeg.site
aspireship.tech
freedomforfarmedrabbits.online
pasalsacongress.com
custommetalimagery.photography
managementcoachinginc.com
hxysjkj.com
trusticoin.biz
wireconnectaz.tech
yoiseikatsu.net
slggroups.com
curiousmug.com
svetarielt.site
nongormart.com
btt5204.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/776-66-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/776-67-0x000000000041D520-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f92898079644c77d76a03ad969332f03.exedescription pid process target process PID 1088 set thread context of 776 1088 f92898079644c77d76a03ad969332f03.exe f92898079644c77d76a03ad969332f03.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
f92898079644c77d76a03ad969332f03.exepid process 776 f92898079644c77d76a03ad969332f03.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
f92898079644c77d76a03ad969332f03.exedescription pid process target process PID 1088 wrote to memory of 776 1088 f92898079644c77d76a03ad969332f03.exe f92898079644c77d76a03ad969332f03.exe PID 1088 wrote to memory of 776 1088 f92898079644c77d76a03ad969332f03.exe f92898079644c77d76a03ad969332f03.exe PID 1088 wrote to memory of 776 1088 f92898079644c77d76a03ad969332f03.exe f92898079644c77d76a03ad969332f03.exe PID 1088 wrote to memory of 776 1088 f92898079644c77d76a03ad969332f03.exe f92898079644c77d76a03ad969332f03.exe PID 1088 wrote to memory of 776 1088 f92898079644c77d76a03ad969332f03.exe f92898079644c77d76a03ad969332f03.exe PID 1088 wrote to memory of 776 1088 f92898079644c77d76a03ad969332f03.exe f92898079644c77d76a03ad969332f03.exe PID 1088 wrote to memory of 776 1088 f92898079644c77d76a03ad969332f03.exe f92898079644c77d76a03ad969332f03.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f92898079644c77d76a03ad969332f03.exe"C:\Users\Admin\AppData\Local\Temp\f92898079644c77d76a03ad969332f03.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\f92898079644c77d76a03ad969332f03.exe"C:\Users\Admin\AppData\Local\Temp\f92898079644c77d76a03ad969332f03.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:776
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/776-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/776-67-0x000000000041D520-mapping.dmp
-
memory/776-68-0x0000000000A20000-0x0000000000D23000-memory.dmpFilesize
3.0MB
-
memory/1088-60-0x0000000000D60000-0x0000000000D61000-memory.dmpFilesize
4KB
-
memory/1088-62-0x0000000004820000-0x0000000004821000-memory.dmpFilesize
4KB
-
memory/1088-63-0x0000000000820000-0x000000000083D000-memory.dmpFilesize
116KB
-
memory/1088-64-0x0000000005380000-0x00000000053DC000-memory.dmpFilesize
368KB
-
memory/1088-65-0x0000000000970000-0x000000000099C000-memory.dmpFilesize
176KB