Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
13-12-2021 09:01
Static task
static1
Behavioral task
behavioral1
Sample
RequestLetter 11DEC.exe
Resource
win7-en-20211208
General
-
Target
RequestLetter 11DEC.exe
-
Size
907KB
-
MD5
eb62d3d13ff0e6dc6e3daa1b2513676c
-
SHA1
98a8345372e8b6ff98826c35f55fe594384eb235
-
SHA256
993e2502c86bc87766ee853a75c89ffe6a635383c685b1aea785364b7c101b59
-
SHA512
0592c3a025423d1b718a9d05a0619a2939877f420123580e02343d830ede8789df6a661b7745d3a3f046a7c9f33431179188390ed9b8f577138703bd9af92042
Malware Config
Extracted
xloader
2.5
ef6c
http://www.fis.photos/ef6c/
gicaredocs.com
govusergroup.com
conversationspit.com
brondairy.com
rjtherealest.com
xn--9m1bq8wgkag3rjvb.com
mylori.net
softandcute.store
ahljsm.com
shacksolid.com
weekendmusecollection.com
gaminghallarna.net
pgonline111.online
44mpt.xyz
ambrandt.com
eddytattoo.com
blendeqes.com
upinmyfeels.com
lacucinadesign.com
docomoau.xyz
xn--90armbk7e.online
xzq585858.net
kidzgovroom.com
lhznqyl.press
publicationsplace.com
jakante.com
csspadding.com
test-testjisdnsec.store
lafabriqueabeilleassurances.com
clf010.com
buybabysnuggle.com
uzmdrmustafaalperaykanat.com
levanttradegroup.com
arcflorals.com
kinglot2499.com
freekagyans.com
region10group.gmbh
yeyelm744.com
thehomedesigncentre.com
vngc.xyz
szesdkj.com
charlottewright.online
planetgreennetwork.com
pacifica7.com
analogueadapt.com
sensorypantry.com
narbaal.com
restaurant-utopia.xyz
golnay.com
szyyglass.com
redelirevearyseuiop.xyz
goldsteelconstruction.com
discovercotswoldcottages.com
geniuseven.net
apricitee.com
stopmoshenik.online
ya2gh.com
instatechnovelz.com
dbe648.com
seifjuban.com
conquershirts.store
totalcovidtravel.com
pamperotrabajo.com
satellitphonestore.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1028-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1028-63-0x000000000041D3D0-mapping.dmp xloader behavioral1/memory/836-70-0x0000000000070000-0x0000000000099000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1076 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
RequestLetter 11DEC.exeRequestLetter 11DEC.exewscript.exedescription pid process target process PID 1892 set thread context of 1028 1892 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 1028 set thread context of 1376 1028 RequestLetter 11DEC.exe Explorer.EXE PID 836 set thread context of 1376 836 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
RequestLetter 11DEC.exeRequestLetter 11DEC.exewscript.exepid process 1892 RequestLetter 11DEC.exe 1028 RequestLetter 11DEC.exe 1028 RequestLetter 11DEC.exe 836 wscript.exe 836 wscript.exe 836 wscript.exe 836 wscript.exe 836 wscript.exe 836 wscript.exe 836 wscript.exe 836 wscript.exe 836 wscript.exe 836 wscript.exe 836 wscript.exe 836 wscript.exe 836 wscript.exe 836 wscript.exe 836 wscript.exe 836 wscript.exe 836 wscript.exe 836 wscript.exe 836 wscript.exe 836 wscript.exe 836 wscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RequestLetter 11DEC.exewscript.exepid process 1028 RequestLetter 11DEC.exe 1028 RequestLetter 11DEC.exe 1028 RequestLetter 11DEC.exe 836 wscript.exe 836 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RequestLetter 11DEC.exeRequestLetter 11DEC.exewscript.exedescription pid process Token: SeDebugPrivilege 1892 RequestLetter 11DEC.exe Token: SeDebugPrivilege 1028 RequestLetter 11DEC.exe Token: SeDebugPrivilege 836 wscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
RequestLetter 11DEC.exeExplorer.EXEwscript.exedescription pid process target process PID 1892 wrote to memory of 1428 1892 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 1892 wrote to memory of 1428 1892 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 1892 wrote to memory of 1428 1892 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 1892 wrote to memory of 1428 1892 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 1892 wrote to memory of 1028 1892 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 1892 wrote to memory of 1028 1892 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 1892 wrote to memory of 1028 1892 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 1892 wrote to memory of 1028 1892 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 1892 wrote to memory of 1028 1892 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 1892 wrote to memory of 1028 1892 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 1892 wrote to memory of 1028 1892 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 1376 wrote to memory of 836 1376 Explorer.EXE wscript.exe PID 1376 wrote to memory of 836 1376 Explorer.EXE wscript.exe PID 1376 wrote to memory of 836 1376 Explorer.EXE wscript.exe PID 1376 wrote to memory of 836 1376 Explorer.EXE wscript.exe PID 836 wrote to memory of 1076 836 wscript.exe cmd.exe PID 836 wrote to memory of 1076 836 wscript.exe cmd.exe PID 836 wrote to memory of 1076 836 wscript.exe cmd.exe PID 836 wrote to memory of 1076 836 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RequestLetter 11DEC.exe"C:\Users\Admin\AppData\Local\Temp\RequestLetter 11DEC.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RequestLetter 11DEC.exe"C:\Users\Admin\AppData\Local\Temp\RequestLetter 11DEC.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\RequestLetter 11DEC.exe"C:\Users\Admin\AppData\Local\Temp\RequestLetter 11DEC.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RequestLetter 11DEC.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/836-68-0x0000000000000000-mapping.dmp
-
memory/836-73-0x0000000001F90000-0x0000000002020000-memory.dmpFilesize
576KB
-
memory/836-71-0x0000000002080000-0x0000000002383000-memory.dmpFilesize
3.0MB
-
memory/836-70-0x0000000000070000-0x0000000000099000-memory.dmpFilesize
164KB
-
memory/836-69-0x00000000002C0000-0x00000000002E6000-memory.dmpFilesize
152KB
-
memory/1028-63-0x000000000041D3D0-mapping.dmp
-
memory/1028-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1028-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1028-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1028-66-0x0000000000280000-0x0000000000291000-memory.dmpFilesize
68KB
-
memory/1028-65-0x00000000009E0000-0x0000000000CE3000-memory.dmpFilesize
3.0MB
-
memory/1076-72-0x0000000000000000-mapping.dmp
-
memory/1376-67-0x0000000007110000-0x00000000072A4000-memory.dmpFilesize
1.6MB
-
memory/1376-74-0x0000000006B90000-0x0000000006CE8000-memory.dmpFilesize
1.3MB
-
memory/1892-54-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/1892-59-0x0000000005570000-0x0000000005686000-memory.dmpFilesize
1.1MB
-
memory/1892-58-0x0000000000690000-0x0000000000697000-memory.dmpFilesize
28KB
-
memory/1892-57-0x0000000004990000-0x0000000004991000-memory.dmpFilesize
4KB
-
memory/1892-56-0x00000000751B1000-0x00000000751B3000-memory.dmpFilesize
8KB