Analysis
-
max time kernel
75s -
max time network
26s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
23-09-2021 07:55
Static task
static1
Behavioral task
behavioral1
Sample
1c3047465bb31dd2ac45101680301992.exe
Resource
win7-en-20210920
General
-
Target
1c3047465bb31dd2ac45101680301992.exe
-
Size
761KB
-
MD5
1c3047465bb31dd2ac45101680301992
-
SHA1
36219c9148dafb036bc5871c440cbcf959d1b683
-
SHA256
995c349e77a02cf1d77af852797437f2cd89914f41f493fa7f352549f374d7d3
-
SHA512
cc4ef5a89b34067434e478a8e9d96e212dc1cdb0b8c128d7ab6890e91cb4c4f0170270b86ae872219c4adfbe1bcb19490beadbe65ae4f296aabc9b802ed93d74
Malware Config
Extracted
xloader
2.5
arup
http://www.sapphiretype.com/arup/
mezonpezon.com
bellapbd.com
xn--2kr800ab2z.group
cupecoysuites.com
extractselect.com
cherrycooky.com
reshawna.com
bluewinetours.com
dez2fly.com
washedproductions.com
om-asahi-kasei-jp.com
talkingpoint.tours
avaspacecompany.com
fbtvmall.com
trocaoferta.com
mionegozio.com
reitschuetz.com
basepicks.com
networkagricity.com
kastore.club
groovydeer.com
realisa.net
891708.com
naveenachittibiyina.com
guizhouawj.com
royaltortoisecookieco.online
scubafarm.com
sibo.care
rapi-vet.com
metaid.website
shadoworksart.com
gratitudegalore.com
penhal.com
fetch-an-us-itchy.zone
melisaakyolicmimarlik.com
yiweise.com
sofasstorremolinos.com
rfanil.com
metaverselemon.com
theholidaymovieplanner.com
n4sins.com
fortcor.com
galaxysingle.com
gzwqpsyj.com
azur-riviera-rental.com
bharathpaperbagmachine.com
pinup722bk.com
darkness.global
theihearthotel.com
wecowork.net
big-thoughtconsulting.com
ricartepinlac.com
beatsingh.com
xn--e6qg25lq0kdudqy7g.com
zkingstore.com
gd83574.com
jiajssie.xyz
patientempowered.care
tiannuoxxrp.top
itsnalab.com
ioumal.com
bellinghamapartment.com
sakibotchi.com
jessicapets.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1668-59-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1668-60-0x000000000041D4B0-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1c3047465bb31dd2ac45101680301992.exedescription pid process target process PID 1756 set thread context of 1668 1756 1c3047465bb31dd2ac45101680301992.exe 1c3047465bb31dd2ac45101680301992.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
1c3047465bb31dd2ac45101680301992.exe1c3047465bb31dd2ac45101680301992.exepid process 1756 1c3047465bb31dd2ac45101680301992.exe 1756 1c3047465bb31dd2ac45101680301992.exe 1668 1c3047465bb31dd2ac45101680301992.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1c3047465bb31dd2ac45101680301992.exedescription pid process Token: SeDebugPrivilege 1756 1c3047465bb31dd2ac45101680301992.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
1c3047465bb31dd2ac45101680301992.exedescription pid process target process PID 1756 wrote to memory of 724 1756 1c3047465bb31dd2ac45101680301992.exe 1c3047465bb31dd2ac45101680301992.exe PID 1756 wrote to memory of 724 1756 1c3047465bb31dd2ac45101680301992.exe 1c3047465bb31dd2ac45101680301992.exe PID 1756 wrote to memory of 724 1756 1c3047465bb31dd2ac45101680301992.exe 1c3047465bb31dd2ac45101680301992.exe PID 1756 wrote to memory of 724 1756 1c3047465bb31dd2ac45101680301992.exe 1c3047465bb31dd2ac45101680301992.exe PID 1756 wrote to memory of 732 1756 1c3047465bb31dd2ac45101680301992.exe 1c3047465bb31dd2ac45101680301992.exe PID 1756 wrote to memory of 732 1756 1c3047465bb31dd2ac45101680301992.exe 1c3047465bb31dd2ac45101680301992.exe PID 1756 wrote to memory of 732 1756 1c3047465bb31dd2ac45101680301992.exe 1c3047465bb31dd2ac45101680301992.exe PID 1756 wrote to memory of 732 1756 1c3047465bb31dd2ac45101680301992.exe 1c3047465bb31dd2ac45101680301992.exe PID 1756 wrote to memory of 1668 1756 1c3047465bb31dd2ac45101680301992.exe 1c3047465bb31dd2ac45101680301992.exe PID 1756 wrote to memory of 1668 1756 1c3047465bb31dd2ac45101680301992.exe 1c3047465bb31dd2ac45101680301992.exe PID 1756 wrote to memory of 1668 1756 1c3047465bb31dd2ac45101680301992.exe 1c3047465bb31dd2ac45101680301992.exe PID 1756 wrote to memory of 1668 1756 1c3047465bb31dd2ac45101680301992.exe 1c3047465bb31dd2ac45101680301992.exe PID 1756 wrote to memory of 1668 1756 1c3047465bb31dd2ac45101680301992.exe 1c3047465bb31dd2ac45101680301992.exe PID 1756 wrote to memory of 1668 1756 1c3047465bb31dd2ac45101680301992.exe 1c3047465bb31dd2ac45101680301992.exe PID 1756 wrote to memory of 1668 1756 1c3047465bb31dd2ac45101680301992.exe 1c3047465bb31dd2ac45101680301992.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c3047465bb31dd2ac45101680301992.exe"C:\Users\Admin\AppData\Local\Temp\1c3047465bb31dd2ac45101680301992.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1c3047465bb31dd2ac45101680301992.exe"C:\Users\Admin\AppData\Local\Temp\1c3047465bb31dd2ac45101680301992.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1c3047465bb31dd2ac45101680301992.exe"C:\Users\Admin\AppData\Local\Temp\1c3047465bb31dd2ac45101680301992.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1c3047465bb31dd2ac45101680301992.exe"C:\Users\Admin\AppData\Local\Temp\1c3047465bb31dd2ac45101680301992.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1668-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1668-60-0x000000000041D4B0-mapping.dmp
-
memory/1668-61-0x0000000000900000-0x0000000000C03000-memory.dmpFilesize
3.0MB
-
memory/1756-53-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/1756-55-0x0000000004F60000-0x0000000004F61000-memory.dmpFilesize
4KB
-
memory/1756-56-0x00000000004C0000-0x00000000004DD000-memory.dmpFilesize
116KB
-
memory/1756-57-0x00000000057E0000-0x000000000584B000-memory.dmpFilesize
428KB
-
memory/1756-58-0x0000000001FC0000-0x0000000001FFB000-memory.dmpFilesize
236KB