Analysis
-
max time kernel
148s -
max time network
70s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
28-09-2021 06:20
Static task
static1
Behavioral task
behavioral1
Sample
4c70d5b1c63a468f7e0aedf64f93ca42.exe
Resource
win7-en-20210920
General
-
Target
4c70d5b1c63a468f7e0aedf64f93ca42.exe
-
Size
1024KB
-
MD5
4c70d5b1c63a468f7e0aedf64f93ca42
-
SHA1
c248ab00560786b7be23151597d9503a2e84602f
-
SHA256
83242a0f42be34e66e502e4a3a45d2470f3b24aef8a1d8484711f4439d7fe74a
-
SHA512
2146f98b4f950555333a00668ab6f71ad2a432b12d12cb0c07cc2dc342884f88b491442c84da763b3101ee7ac89e8c08f6552203ba9470401e934191e4858a8c
Malware Config
Extracted
xloader
2.5
mjyv
http://www.simpeltattofor.men/mjyv/
wenyuexuan.com
tropicaldepression.info
healthylifefit.com
reemletenleafy.com
jmrrve.com
mabduh.com
esomvw.com
selfcaresereneneness.com
murdabudz.com
meinemail.online
brandqrcodes.com
live-in-pflege.com
nickrecovery.com
ziototoristorante.com
chatcure.com
corlora.com
localagentlab.com
yogo7.net
krveop.com
heianswer.xyz
idproslot.xyz
anielleharris.com
lebonaharchitects.com
chilestew.com
ventasdecasasylotes.xyz
welcome-sber.store
ahmedintisher.com
pastlinks.com
productprinting.online
babybox.media
volteraenergy.net
chinatowndeliver.com
behiscalm.com
totalselfconfidence.net
single-on-purpose.com
miyonbuilding.com
medicalmanagementinc.info
bellaalubo.com
dubaibiologicdentist.com
jspagnier-graveur.com
deskbk.com
thehauntdepot.com
5fbuy.com
calmingscience.com
luvnecklace.com
noun-bug.com
mysenarai.com
socialmediaplugin.com
livinglovinglincoln.com
vaxfreeschool.com
bjjinmei.com
p60p.com
upgradepklohb.xyz
georges-lego.com
lkkogltoyof4.xyz
fryhealty.com
peacetransformationpath.com
lightfootsteps.com
recreativemysteriousgift.com
luminoza.website
mccorklehometeam.com
car-insurance-rates-x2.info
serpasboutiquedecarnes.com
1971event.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/364-120-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/364-121-0x000000000041D460-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4c70d5b1c63a468f7e0aedf64f93ca42.exedescription pid process target process PID 664 set thread context of 364 664 4c70d5b1c63a468f7e0aedf64f93ca42.exe 4c70d5b1c63a468f7e0aedf64f93ca42.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4c70d5b1c63a468f7e0aedf64f93ca42.exepid process 364 4c70d5b1c63a468f7e0aedf64f93ca42.exe 364 4c70d5b1c63a468f7e0aedf64f93ca42.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4c70d5b1c63a468f7e0aedf64f93ca42.exedescription pid process Token: SeDebugPrivilege 664 4c70d5b1c63a468f7e0aedf64f93ca42.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
4c70d5b1c63a468f7e0aedf64f93ca42.exedescription pid process target process PID 664 wrote to memory of 364 664 4c70d5b1c63a468f7e0aedf64f93ca42.exe 4c70d5b1c63a468f7e0aedf64f93ca42.exe PID 664 wrote to memory of 364 664 4c70d5b1c63a468f7e0aedf64f93ca42.exe 4c70d5b1c63a468f7e0aedf64f93ca42.exe PID 664 wrote to memory of 364 664 4c70d5b1c63a468f7e0aedf64f93ca42.exe 4c70d5b1c63a468f7e0aedf64f93ca42.exe PID 664 wrote to memory of 364 664 4c70d5b1c63a468f7e0aedf64f93ca42.exe 4c70d5b1c63a468f7e0aedf64f93ca42.exe PID 664 wrote to memory of 364 664 4c70d5b1c63a468f7e0aedf64f93ca42.exe 4c70d5b1c63a468f7e0aedf64f93ca42.exe PID 664 wrote to memory of 364 664 4c70d5b1c63a468f7e0aedf64f93ca42.exe 4c70d5b1c63a468f7e0aedf64f93ca42.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c70d5b1c63a468f7e0aedf64f93ca42.exe"C:\Users\Admin\AppData\Local\Temp\4c70d5b1c63a468f7e0aedf64f93ca42.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4c70d5b1c63a468f7e0aedf64f93ca42.exe"C:\Users\Admin\AppData\Local\Temp\4c70d5b1c63a468f7e0aedf64f93ca42.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/364-120-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/364-121-0x000000000041D460-mapping.dmp
-
memory/364-122-0x0000000001580000-0x00000000018A0000-memory.dmpFilesize
3.1MB
-
memory/664-114-0x0000000001030000-0x0000000001031000-memory.dmpFilesize
4KB
-
memory/664-116-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/664-117-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/664-118-0x0000000004B40000-0x0000000004B41000-memory.dmpFilesize
4KB
-
memory/664-119-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB