Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
21-10-2021 09:45
Static task
static1
Behavioral task
behavioral1
Sample
188a0c1b3179c00fa189e73b772dcd72.exe
Resource
win7-en-20211014
General
-
Target
188a0c1b3179c00fa189e73b772dcd72.exe
-
Size
417KB
-
MD5
188a0c1b3179c00fa189e73b772dcd72
-
SHA1
efa12177184000acf7236187b9582ba204ac1387
-
SHA256
0997b2cc23e6aa9743c78ccaba88fb036bc03937011a12bbb367e6b457461c0b
-
SHA512
8feec5cadd9710eda47653eb26041c99b7915d5a664f90b9daabfddb65651be6161c9b21bece2943c8d8ae54a1ec44f6aaabbb1bd964791abe3cc020d771bad0
Malware Config
Extracted
xloader
2.5
wogm
http://www.eygtogel021.com/wogm/
sub-dude.net
repeatcustom.com
goodspaz.com
sinagropuree.com
jyh8886.com
muescabynes.quest
stark.agency
nolimit168.com
hypermediastore.com
arab-xt-pro.com
gruppovimar.com
santamariamoto.express
affaridistribuciones.com
straetah.com
collectionsbyvivi.com
nalainteriores.com
weeklywars.com
insightmyhome.com
ucml.net
herderguru.com
sz-jialejia.com
xinglu56.com
tenselect.net
arepaspuesdc.com
cvkf.email
moseslakeapartment.com
chantaldesign.space
884651.com
yzyf88.com
seattlecanna.com
obsessive.company
blessedfurnitures.com
disparandose.com
smmakrygiannakis.online
buno8ce.com
javaportal.info
laoqu6666.com
portfolioinsidertips.com
workospbit.space
biocrafts.net
estebancantillo.com
appliancestar.xyz
gloriousbees.xyz
porchlightwoodworks.com
rawhoneytnpasumo2.xyz
pokipass-niigata.com
aodesai.store
powro.online
playin.one
minded-afoot.com
zpahura.com
bodybybetsy.com
camworker.cloud
mest2.com
chezlulu.paris
officeupdate365.com
jackdanska.com
glenndcp.com
huikanvip.com
connectedtoolstore.com
flogicpro.com
yourhomestimate.com
dogtraining5x5.com
truenettnpasumo2.xyz
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3828-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3828-125-0x000000000041D430-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
188a0c1b3179c00fa189e73b772dcd72.exedescription pid process target process PID 1380 set thread context of 3828 1380 188a0c1b3179c00fa189e73b772dcd72.exe 188a0c1b3179c00fa189e73b772dcd72.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
188a0c1b3179c00fa189e73b772dcd72.exepid process 3828 188a0c1b3179c00fa189e73b772dcd72.exe 3828 188a0c1b3179c00fa189e73b772dcd72.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
188a0c1b3179c00fa189e73b772dcd72.exedescription pid process target process PID 1380 wrote to memory of 3828 1380 188a0c1b3179c00fa189e73b772dcd72.exe 188a0c1b3179c00fa189e73b772dcd72.exe PID 1380 wrote to memory of 3828 1380 188a0c1b3179c00fa189e73b772dcd72.exe 188a0c1b3179c00fa189e73b772dcd72.exe PID 1380 wrote to memory of 3828 1380 188a0c1b3179c00fa189e73b772dcd72.exe 188a0c1b3179c00fa189e73b772dcd72.exe PID 1380 wrote to memory of 3828 1380 188a0c1b3179c00fa189e73b772dcd72.exe 188a0c1b3179c00fa189e73b772dcd72.exe PID 1380 wrote to memory of 3828 1380 188a0c1b3179c00fa189e73b772dcd72.exe 188a0c1b3179c00fa189e73b772dcd72.exe PID 1380 wrote to memory of 3828 1380 188a0c1b3179c00fa189e73b772dcd72.exe 188a0c1b3179c00fa189e73b772dcd72.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\188a0c1b3179c00fa189e73b772dcd72.exe"C:\Users\Admin\AppData\Local\Temp\188a0c1b3179c00fa189e73b772dcd72.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\188a0c1b3179c00fa189e73b772dcd72.exe"C:\Users\Admin\AppData\Local\Temp\188a0c1b3179c00fa189e73b772dcd72.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1380-115-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB
-
memory/1380-117-0x0000000007AC0000-0x0000000007AC1000-memory.dmpFilesize
4KB
-
memory/1380-118-0x0000000007660000-0x0000000007661000-memory.dmpFilesize
4KB
-
memory/1380-119-0x00000000075C0000-0x0000000007ABE000-memory.dmpFilesize
5.0MB
-
memory/1380-120-0x0000000007640000-0x0000000007641000-memory.dmpFilesize
4KB
-
memory/1380-121-0x0000000007AB0000-0x0000000007AB7000-memory.dmpFilesize
28KB
-
memory/1380-122-0x000000000AF40000-0x000000000AF41000-memory.dmpFilesize
4KB
-
memory/1380-123-0x000000000B0E0000-0x000000000B12B000-memory.dmpFilesize
300KB
-
memory/3828-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3828-125-0x000000000041D430-mapping.dmp
-
memory/3828-126-0x00000000017E0000-0x0000000001B00000-memory.dmpFilesize
3.1MB