Analysis
-
max time kernel
121s -
max time network
120s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
15-11-2021 09:20
Static task
static1
Behavioral task
behavioral1
Sample
8cec5b455b359860f5a7aa647331783f.exe
Resource
win7-en-20211014
General
-
Target
8cec5b455b359860f5a7aa647331783f.exe
-
Size
461KB
-
MD5
8cec5b455b359860f5a7aa647331783f
-
SHA1
6a84b356819c29b95ebf305671298879f6c784f1
-
SHA256
29cec08e007fcd2217b0bd25adf7e58e019d4d4c32de795aae95390e4f530c4f
-
SHA512
06607c55fdb311450e64d6ab892b5d673dfd0cbc629dae68f4fe7094de69558e12f6b22977c5be885ecf63de2a3fdce3f608a953493f0fe244a75645114087f2
Malware Config
Extracted
xloader
2.5
n58i
http://www.makingitreignz.com/n58i/
charlottebishop.com
afafshawwabibi.com
salomesac.com
albaelectric.info
ashcm.com
cxlgroups.com
kbittesting.com
stogelair.com
dgredg.com
smokersoutletinc.com
gdmo112.com
innovationmotive.xyz
outbarter.info
abevegege.online
peterjhill.com
fubosportsbetting.com
probristow.com
despirad.com
halloweengeneral.com
milesofsmileskinder.com
luly-boo.com
noordinaryinsurance.com
buildertest342.com
drivelingo.com
idaivos.com
ebonycamsworld.com
mooknationmedia.com
brenthagenbuch.net
rwatyz40s.xyz
ceramicfinishing.com
maliya-interiors.com
ghlmadesimple.com
4546768.rest
povxxxvideos.com
szqkjy.com
1rmg.tech
miskarangsimpang.xyz
jgjec.com
preventpor.xyz
mcdonnellanalytics.store
dsknit.com
high-clicks2.com
niceauto.mobi
kadenselection.com
firuzekahve.com
emiliaclarkedaily.net
trianglepost.press
wellorise.store
bolder.equipment
metropolitanprolifestyle.com
berthagiles.top
tanba-dekanshofarm.net
publicitysocial.com
kosener.com
atelierdesignstudio.com
solosix.club
triimio.com
sukoteishu.com
industrialsblockxchange.com
jsyonghui.com
aspenceramica.com
daikondefense.com
estudioamlegal.com
abetttermountbethel.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/496-123-0x000000000041D470-mapping.dmp xloader behavioral2/memory/496-122-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8cec5b455b359860f5a7aa647331783f.exedescription pid process target process PID 2740 set thread context of 496 2740 8cec5b455b359860f5a7aa647331783f.exe 8cec5b455b359860f5a7aa647331783f.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
8cec5b455b359860f5a7aa647331783f.exepid process 496 8cec5b455b359860f5a7aa647331783f.exe 496 8cec5b455b359860f5a7aa647331783f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
8cec5b455b359860f5a7aa647331783f.exedescription pid process Token: SeDebugPrivilege 2740 8cec5b455b359860f5a7aa647331783f.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
8cec5b455b359860f5a7aa647331783f.exedescription pid process target process PID 2740 wrote to memory of 496 2740 8cec5b455b359860f5a7aa647331783f.exe 8cec5b455b359860f5a7aa647331783f.exe PID 2740 wrote to memory of 496 2740 8cec5b455b359860f5a7aa647331783f.exe 8cec5b455b359860f5a7aa647331783f.exe PID 2740 wrote to memory of 496 2740 8cec5b455b359860f5a7aa647331783f.exe 8cec5b455b359860f5a7aa647331783f.exe PID 2740 wrote to memory of 496 2740 8cec5b455b359860f5a7aa647331783f.exe 8cec5b455b359860f5a7aa647331783f.exe PID 2740 wrote to memory of 496 2740 8cec5b455b359860f5a7aa647331783f.exe 8cec5b455b359860f5a7aa647331783f.exe PID 2740 wrote to memory of 496 2740 8cec5b455b359860f5a7aa647331783f.exe 8cec5b455b359860f5a7aa647331783f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cec5b455b359860f5a7aa647331783f.exe"C:\Users\Admin\AppData\Local\Temp\8cec5b455b359860f5a7aa647331783f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8cec5b455b359860f5a7aa647331783f.exe"C:\Users\Admin\AppData\Local\Temp\8cec5b455b359860f5a7aa647331783f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/496-123-0x000000000041D470-mapping.dmp
-
memory/496-122-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/496-124-0x00000000012D0000-0x00000000015F0000-memory.dmpFilesize
3.1MB
-
memory/2740-115-0x0000000001250000-0x0000000001251000-memory.dmpFilesize
4KB
-
memory/2740-117-0x00000000054C0000-0x00000000054C1000-memory.dmpFilesize
4KB
-
memory/2740-118-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/2740-119-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/2740-120-0x0000000004FC0000-0x00000000054BE000-memory.dmpFilesize
5.0MB
-
memory/2740-121-0x00000000050D0000-0x00000000050D1000-memory.dmpFilesize
4KB