Analysis
-
max time kernel
97s -
max time network
34s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-09-2021 02:32
Static task
static1
Behavioral task
behavioral1
Sample
83843e9448edc71956a3926bbe5dcc28cf29b375.exe
Resource
win7v20210408
General
-
Target
83843e9448edc71956a3926bbe5dcc28cf29b375.exe
-
Size
501KB
-
MD5
d7f127ac909e3fcfed12491dff3d4f29
-
SHA1
83843e9448edc71956a3926bbe5dcc28cf29b375
-
SHA256
a687c755bac51d13e6b038d7e737261fb6922ff8eef86300058048c1f84ec844
-
SHA512
bac89961cb3b9f539d5aa75a9192b37128d108bd47e903eafa36882393fa2c6e1d4990c10041898a928c4b0792a8215b409ad3ce2ee572543f75a3759e01e482
Malware Config
Extracted
xloader
2.3
conv
http://www.7stepsmeal.com/conv/
hydrusgraphene.com
eastwindshomes.com
f1-holding.com
tomrings.com
nickysclosetnest.com
eckare88.com
southboundsupplies.com
asilar.net
ludiali.com
sarahasmussen.com
terreetmerphotography.com
tesserlink.com
xayxcq.com
jobforage.com
76leads.com
onyamarx.com
sandrinafloral.com
a5y7tvmr4.xyz
greatdanesuk.com
superbartendergigs.store
boca-azul.com
bullishsoftware.com
sarahsvirtualofficeteam.com
marketplacestuff.com
simphonya.com
jndzqp.com
testpcrcovid.com
iebcde.com
lfcaihua.com
calvalleysales.com
dunlapandmagee.com
carteddy.com
thelodgepotenza.com
ghoomakadh.com
electrifyitall.com
differentfm.com
ossengeconsulting.com
unisoftwaremarket.com
anhtens.com
anshangbao.com
aerie.sucks
iiotech.xyz
dawnbreakers-guild.com
operatechno.com
palacedepleasure.com
ronaldcraig.com
bangtou123.com
buildtocure.net
portaldoctortv.com
netblocks.exposed
vaiga.pro
serenitypieces.com
redefineyourwork.com
8961599.com
2meducate.com
metalandtubeimpex.com
reviewpayee.com
shopsmallbus.com
shinelogisticsllc.com
silverspiralshop.com
een.xyz
yixinliu.com
recyclewahine.com
gilltales.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/904-65-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/904-66-0x000000000041CFA0-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
83843e9448edc71956a3926bbe5dcc28cf29b375.exedescription pid process target process PID 2000 set thread context of 904 2000 83843e9448edc71956a3926bbe5dcc28cf29b375.exe 83843e9448edc71956a3926bbe5dcc28cf29b375.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
83843e9448edc71956a3926bbe5dcc28cf29b375.exepid process 904 83843e9448edc71956a3926bbe5dcc28cf29b375.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
83843e9448edc71956a3926bbe5dcc28cf29b375.exedescription pid process target process PID 2000 wrote to memory of 904 2000 83843e9448edc71956a3926bbe5dcc28cf29b375.exe 83843e9448edc71956a3926bbe5dcc28cf29b375.exe PID 2000 wrote to memory of 904 2000 83843e9448edc71956a3926bbe5dcc28cf29b375.exe 83843e9448edc71956a3926bbe5dcc28cf29b375.exe PID 2000 wrote to memory of 904 2000 83843e9448edc71956a3926bbe5dcc28cf29b375.exe 83843e9448edc71956a3926bbe5dcc28cf29b375.exe PID 2000 wrote to memory of 904 2000 83843e9448edc71956a3926bbe5dcc28cf29b375.exe 83843e9448edc71956a3926bbe5dcc28cf29b375.exe PID 2000 wrote to memory of 904 2000 83843e9448edc71956a3926bbe5dcc28cf29b375.exe 83843e9448edc71956a3926bbe5dcc28cf29b375.exe PID 2000 wrote to memory of 904 2000 83843e9448edc71956a3926bbe5dcc28cf29b375.exe 83843e9448edc71956a3926bbe5dcc28cf29b375.exe PID 2000 wrote to memory of 904 2000 83843e9448edc71956a3926bbe5dcc28cf29b375.exe 83843e9448edc71956a3926bbe5dcc28cf29b375.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\83843e9448edc71956a3926bbe5dcc28cf29b375.exe"C:\Users\Admin\AppData\Local\Temp\83843e9448edc71956a3926bbe5dcc28cf29b375.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\83843e9448edc71956a3926bbe5dcc28cf29b375.exe"C:\Users\Admin\AppData\Local\Temp\83843e9448edc71956a3926bbe5dcc28cf29b375.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/904-65-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/904-66-0x000000000041CFA0-mapping.dmp
-
memory/904-67-0x0000000000960000-0x0000000000C63000-memory.dmpFilesize
3.0MB
-
memory/2000-59-0x0000000000CC0000-0x0000000000CC1000-memory.dmpFilesize
4KB
-
memory/2000-61-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/2000-62-0x0000000000660000-0x0000000000667000-memory.dmpFilesize
28KB
-
memory/2000-63-0x0000000005070000-0x00000000050D0000-memory.dmpFilesize
384KB
-
memory/2000-64-0x00000000048D0000-0x00000000048FA000-memory.dmpFilesize
168KB