Analysis
-
max time kernel
77s -
max time network
129s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-10-2021 11:01
Static task
static1
General
-
Target
92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe
-
Size
414KB
-
MD5
ff1c94584214d5eef525a0d3ff196a8b
-
SHA1
64841f419c3d8bff98b1ada134ecb8d63be07ec4
-
SHA256
92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8
-
SHA512
9070de7cca07bde86414050f16a73f51c8573e07dca0e8cbac09c870d6f902890d1282dc6f9b1702feb059ad96938ca05dc466bd2004b2c2f670e60ad32f6daa
Malware Config
Extracted
xloader
2.5
mwev
http://www.scion-go-getter.com/mwev/
9linefarms.com
meadow-spring.com
texascountrycharts.com
chinatowndeliver.com
grindsword.com
thegurusigavebirthto.com
rip-online.com
lm-safe-keepingtoyof6.xyz
plumbtechconsulting.com
jgoerlach.com
inbloomsolutions.com
foxandmew.com
tikomobile.store
waybunch.com
thepatriottutor.com
qask.top
pharmacylinked.com
ishii-miona.com
sugarandrocks.com
anabolenpower.net
my9m.com
ywboxiong.xyz
primetire.net
yshxdys.com
royallecleaning.com
xtrategit.com
almashrabia.net
bundlezandco.com
sandman.network
vinhomes-grand-park.com
jbarecipes.com
squareleatherbox.net
breathechurch.digital
wodemcil.com
carthy.foundation
galimfish.com
reflectbag.com
lheteclase.quest
yourvirtualevent.services
custercountycritique.com
liyahgadgets.com
sweetascaramelllc.com
lzgirlz.com
flydubaime.com
aanhanger-verhuur.com
schooldiry.com
theroadtorodriguez.com
mrteez.club
gxystgs.com
runz.online
kometbux.com
mintyhelper.com
bestinvest-4u.com
bjxxc.com
e-readertnpasumo5.xyz
experimentwithoutlimits.com
21yingyang.com
recbi56ni.com
tabulose-milfs-live.com
uglyatoz.com
websitessample.com
gogopficg.xyz
fourthandwhiteoak.com
fulvousemollientplanet.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/352-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/352-125-0x000000000041D480-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exedescription pid process target process PID 3684 set thread context of 352 3684 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exepid process 3684 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe 3684 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe 352 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe 352 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exedescription pid process Token: SeDebugPrivilege 3684 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exedescription pid process target process PID 3684 wrote to memory of 616 3684 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe PID 3684 wrote to memory of 616 3684 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe PID 3684 wrote to memory of 616 3684 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe PID 3684 wrote to memory of 352 3684 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe PID 3684 wrote to memory of 352 3684 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe PID 3684 wrote to memory of 352 3684 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe PID 3684 wrote to memory of 352 3684 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe PID 3684 wrote to memory of 352 3684 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe PID 3684 wrote to memory of 352 3684 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe 92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe"C:\Users\Admin\AppData\Local\Temp\92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe"C:\Users\Admin\AppData\Local\Temp\92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe"C:\Users\Admin\AppData\Local\Temp\92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/352-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/352-125-0x000000000041D480-mapping.dmp
-
memory/352-126-0x0000000001150000-0x0000000001470000-memory.dmpFilesize
3.1MB
-
memory/3684-115-0x0000000000FA0000-0x0000000000FA1000-memory.dmpFilesize
4KB
-
memory/3684-117-0x0000000005EF0000-0x0000000005EF1000-memory.dmpFilesize
4KB
-
memory/3684-118-0x00000000059F0000-0x00000000059F1000-memory.dmpFilesize
4KB
-
memory/3684-119-0x00000000059D0000-0x00000000059D1000-memory.dmpFilesize
4KB
-
memory/3684-120-0x0000000005B00000-0x0000000005B01000-memory.dmpFilesize
4KB
-
memory/3684-121-0x0000000005CE0000-0x0000000005CE6000-memory.dmpFilesize
24KB
-
memory/3684-122-0x0000000008280000-0x0000000008281000-memory.dmpFilesize
4KB
-
memory/3684-123-0x0000000008230000-0x000000000827B000-memory.dmpFilesize
300KB