Analysis
-
max time kernel
82s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
10-11-2021 17:57
Static task
static1
Behavioral task
behavioral1
Sample
5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe
Resource
win7-en-20211014
General
-
Target
5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe
-
Size
290KB
-
MD5
521339ae9fa89c3af1b50456781272a8
-
SHA1
3e79f4911ff9187b0300dcca9d0dcc6108afaecb
-
SHA256
5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82
-
SHA512
54a1f89f2711ed2aa8d10e0a57bf287b84ca02be78e42960bf4defbb8bbfb6707bc58052a433a199f05121b8e155105209c409afe9e81547c7e573f39acddff3
Malware Config
Extracted
xloader
2.5
pufi
http://www.homestechs.com/pufi/
fusiongroupgames.net
hugevari.com
rebeccagriffiths.com
trocaoferta.com
theslashapp.com
codezonesoftware.xyz
sottocommunications.com
minicreators.online
course2millions.com
hfm5n1dhkjqwpe.xyz
xlab-ub.com
silvanaribeirocake.com
thefabinteriordesign.com
mg-leadership.com
petbort.com
ndust.net
203040302.xyz
jakital.com
shophuunghia.info
rednacionaldejuecesrd.net
mauricioeanderson.com
robinbirrell.top
zarazira.com
rescueandrestoreministries.net
tureformamadrid.com
heesafe.com
mistergoo.com
reklamilanlar018.xyz
dailygossiping.com
theebook.guru
keepkalmm.com
teamlsu.club
kendyraedesigns.com
suddennnnnnnnnnnn13.xyz
panaceapp.com
visionaryking83.com
50003008.com
bikingforbalance.com
nishiki-sougou.com
bricokitchen.com
478739.com
donaldpowers.store
lesspricebd.com
xn--tfr61gf5uuhm.group
mysterypowerbike.com
fractalmerch.xyz
foreverphotos0910.net
hungama-play30.online
negotrad.com
afroonline.net
avalche.com
northfacemall.online
deals4me.store
nadanadif.com
lnstagrarn-security.com
lewismiddleton.com
tefatistmus.quest
adavici.com
madnext.online
astraherb.com
phnurse.com
opinionprofesional.com
gameshill.net
kagakubushitsu.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/872-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/872-126-0x000000000041D450-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exedescription pid process target process PID 2536 set thread context of 872 2536 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exepid process 2536 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe 2536 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe 872 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe 872 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exedescription pid process Token: SeDebugPrivilege 2536 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exedescription pid process target process PID 2536 wrote to memory of 872 2536 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe PID 2536 wrote to memory of 872 2536 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe PID 2536 wrote to memory of 872 2536 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe PID 2536 wrote to memory of 872 2536 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe PID 2536 wrote to memory of 872 2536 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe PID 2536 wrote to memory of 872 2536 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe"C:\Users\Admin\AppData\Local\Temp\5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exeC:\Users\Admin\AppData\Local\Temp\5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/872-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/872-126-0x000000000041D450-mapping.dmp
-
memory/872-127-0x0000000001830000-0x0000000001B50000-memory.dmpFilesize
3.1MB
-
memory/2536-118-0x0000000000D20000-0x0000000000D21000-memory.dmpFilesize
4KB
-
memory/2536-120-0x0000000005890000-0x0000000005891000-memory.dmpFilesize
4KB
-
memory/2536-121-0x0000000005DA0000-0x0000000005E00000-memory.dmpFilesize
384KB
-
memory/2536-122-0x0000000005EA0000-0x0000000005EA1000-memory.dmpFilesize
4KB
-
memory/2536-123-0x0000000006410000-0x0000000006411000-memory.dmpFilesize
4KB
-
memory/2536-124-0x0000000006080000-0x00000000060AA000-memory.dmpFilesize
168KB