Analysis
-
max time kernel
88s -
max time network
131s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
02-12-2021 18:59
Static task
static1
General
-
Target
23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe
-
Size
406KB
-
MD5
192b796d92d190c45204571599c38c86
-
SHA1
611559df5b74934dea4c81a5490e2c64a73ee6e0
-
SHA256
23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e
-
SHA512
da9e4bb2300d2968125427d122d5e81cecf2d342dc2c17fc16d5dc1ac7f511d53e75233c1844c1948f6a82740818166229e7ea2411a40351c54e8e97a3b4ec42
Malware Config
Extracted
xloader
2.5
mwev
http://www.scion-go-getter.com/mwev/
9linefarms.com
meadow-spring.com
texascountrycharts.com
chinatowndeliver.com
grindsword.com
thegurusigavebirthto.com
rip-online.com
lm-safe-keepingtoyof6.xyz
plumbtechconsulting.com
jgoerlach.com
inbloomsolutions.com
foxandmew.com
tikomobile.store
waybunch.com
thepatriottutor.com
qask.top
pharmacylinked.com
ishii-miona.com
sugarandrocks.com
anabolenpower.net
my9m.com
ywboxiong.xyz
primetire.net
yshxdys.com
royallecleaning.com
xtrategit.com
almashrabia.net
bundlezandco.com
sandman.network
vinhomes-grand-park.com
jbarecipes.com
squareleatherbox.net
breathechurch.digital
wodemcil.com
carthy.foundation
galimfish.com
reflectbag.com
lheteclase.quest
yourvirtualevent.services
custercountycritique.com
liyahgadgets.com
sweetascaramelllc.com
lzgirlz.com
flydubaime.com
aanhanger-verhuur.com
schooldiry.com
theroadtorodriguez.com
mrteez.club
gxystgs.com
runz.online
kometbux.com
mintyhelper.com
bestinvest-4u.com
bjxxc.com
e-readertnpasumo5.xyz
experimentwithoutlimits.com
21yingyang.com
recbi56ni.com
tabulose-milfs-live.com
uglyatoz.com
websitessample.com
gogopficg.xyz
fourthandwhiteoak.com
fulvousemollientplanet.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3108-128-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/3108-129-0x000000000041D480-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exedescription pid process target process PID 2580 set thread context of 3108 2580 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exepid process 2580 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe 2580 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe 2580 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe 2580 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe 3108 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe 3108 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exedescription pid process Token: SeDebugPrivilege 2580 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exedescription pid process target process PID 2580 wrote to memory of 532 2580 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe PID 2580 wrote to memory of 532 2580 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe PID 2580 wrote to memory of 532 2580 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe PID 2580 wrote to memory of 652 2580 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe PID 2580 wrote to memory of 652 2580 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe PID 2580 wrote to memory of 652 2580 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe PID 2580 wrote to memory of 3108 2580 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe PID 2580 wrote to memory of 3108 2580 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe PID 2580 wrote to memory of 3108 2580 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe PID 2580 wrote to memory of 3108 2580 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe PID 2580 wrote to memory of 3108 2580 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe PID 2580 wrote to memory of 3108 2580 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe 23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe"C:\Users\Admin\AppData\Local\Temp\23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe"C:\Users\Admin\AppData\Local\Temp\23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe"C:\Users\Admin\AppData\Local\Temp\23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe"C:\Users\Admin\AppData\Local\Temp\23c8bfea897f9833766ceab96299a77ad19ed1e0897b7e30d56d2c56c30d2d4e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2580-118-0x00000000007E0000-0x00000000007E1000-memory.dmpFilesize
4KB
-
memory/2580-120-0x0000000005710000-0x0000000005711000-memory.dmpFilesize
4KB
-
memory/2580-121-0x00000000050D0000-0x00000000050D1000-memory.dmpFilesize
4KB
-
memory/2580-122-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/2580-123-0x00000000051E0000-0x00000000051E8000-memory.dmpFilesize
32KB
-
memory/2580-124-0x0000000005620000-0x0000000005621000-memory.dmpFilesize
4KB
-
memory/2580-125-0x0000000005030000-0x00000000050C2000-memory.dmpFilesize
584KB
-
memory/2580-126-0x0000000005EB0000-0x0000000005EB1000-memory.dmpFilesize
4KB
-
memory/2580-127-0x0000000005F50000-0x0000000005FA8000-memory.dmpFilesize
352KB
-
memory/3108-128-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3108-129-0x000000000041D480-mapping.dmp
-
memory/3108-130-0x00000000016A0000-0x00000000019C0000-memory.dmpFilesize
3.1MB