Analysis
-
max time kernel
105s -
max time network
127s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
01-11-2021 09:57
Static task
static1
General
-
Target
99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe
-
Size
540KB
-
MD5
c0225f76705c05744918c724e3018649
-
SHA1
8fb4c2a855204c51c630b69ccfdf10f1135fe01e
-
SHA256
99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c
-
SHA512
04b016e7b30c59e316a5b82e42560a82892c52d2fca26e6eacb9fdc2b1254c4b544467a1617989f3166606c8f0d7ebb4e0d85400bab785d29a6cd15e71e5da1c
Malware Config
Extracted
xloader
2.5
mwev
http://www.scion-go-getter.com/mwev/
9linefarms.com
meadow-spring.com
texascountrycharts.com
chinatowndeliver.com
grindsword.com
thegurusigavebirthto.com
rip-online.com
lm-safe-keepingtoyof6.xyz
plumbtechconsulting.com
jgoerlach.com
inbloomsolutions.com
foxandmew.com
tikomobile.store
waybunch.com
thepatriottutor.com
qask.top
pharmacylinked.com
ishii-miona.com
sugarandrocks.com
anabolenpower.net
my9m.com
ywboxiong.xyz
primetire.net
yshxdys.com
royallecleaning.com
xtrategit.com
almashrabia.net
bundlezandco.com
sandman.network
vinhomes-grand-park.com
jbarecipes.com
squareleatherbox.net
breathechurch.digital
wodemcil.com
carthy.foundation
galimfish.com
reflectbag.com
lheteclase.quest
yourvirtualevent.services
custercountycritique.com
liyahgadgets.com
sweetascaramelllc.com
lzgirlz.com
flydubaime.com
aanhanger-verhuur.com
schooldiry.com
theroadtorodriguez.com
mrteez.club
gxystgs.com
runz.online
kometbux.com
mintyhelper.com
bestinvest-4u.com
bjxxc.com
e-readertnpasumo5.xyz
experimentwithoutlimits.com
21yingyang.com
recbi56ni.com
tabulose-milfs-live.com
uglyatoz.com
websitessample.com
gogopficg.xyz
fourthandwhiteoak.com
fulvousemollientplanet.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3568-127-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/3568-128-0x000000000041D480-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exedescription pid process target process PID 3512 set thread context of 3568 3512 99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe 99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exepid process 3568 99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe 3568 99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exedescription pid process target process PID 3512 wrote to memory of 3568 3512 99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe 99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe PID 3512 wrote to memory of 3568 3512 99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe 99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe PID 3512 wrote to memory of 3568 3512 99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe 99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe PID 3512 wrote to memory of 3568 3512 99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe 99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe PID 3512 wrote to memory of 3568 3512 99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe 99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe PID 3512 wrote to memory of 3568 3512 99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe 99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe"C:\Users\Admin\AppData\Local\Temp\99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe"C:\Users\Admin\AppData\Local\Temp\99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3512-118-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/3512-120-0x00000000059E0000-0x00000000059E1000-memory.dmpFilesize
4KB
-
memory/3512-121-0x0000000005580000-0x0000000005581000-memory.dmpFilesize
4KB
-
memory/3512-122-0x00000000054E0000-0x00000000059DE000-memory.dmpFilesize
5.0MB
-
memory/3512-123-0x0000000005500000-0x0000000005501000-memory.dmpFilesize
4KB
-
memory/3512-124-0x0000000005990000-0x0000000005997000-memory.dmpFilesize
28KB
-
memory/3512-125-0x00000000073F0000-0x00000000073F1000-memory.dmpFilesize
4KB
-
memory/3512-126-0x0000000007490000-0x00000000074DC000-memory.dmpFilesize
304KB
-
memory/3568-127-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3568-128-0x000000000041D480-mapping.dmp
-
memory/3568-129-0x00000000019A0000-0x0000000001CC0000-memory.dmpFilesize
3.1MB