Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
13-12-2021 09:01
Static task
static1
Behavioral task
behavioral1
Sample
RequestLetter 11DEC.exe
Resource
win7-en-20211208
General
-
Target
RequestLetter 11DEC.exe
-
Size
907KB
-
MD5
eb62d3d13ff0e6dc6e3daa1b2513676c
-
SHA1
98a8345372e8b6ff98826c35f55fe594384eb235
-
SHA256
993e2502c86bc87766ee853a75c89ffe6a635383c685b1aea785364b7c101b59
-
SHA512
0592c3a025423d1b718a9d05a0619a2939877f420123580e02343d830ede8789df6a661b7745d3a3f046a7c9f33431179188390ed9b8f577138703bd9af92042
Malware Config
Extracted
xloader
2.5
ef6c
http://www.fis.photos/ef6c/
gicaredocs.com
govusergroup.com
conversationspit.com
brondairy.com
rjtherealest.com
xn--9m1bq8wgkag3rjvb.com
mylori.net
softandcute.store
ahljsm.com
shacksolid.com
weekendmusecollection.com
gaminghallarna.net
pgonline111.online
44mpt.xyz
ambrandt.com
eddytattoo.com
blendeqes.com
upinmyfeels.com
lacucinadesign.com
docomoau.xyz
xn--90armbk7e.online
xzq585858.net
kidzgovroom.com
lhznqyl.press
publicationsplace.com
jakante.com
csspadding.com
test-testjisdnsec.store
lafabriqueabeilleassurances.com
clf010.com
buybabysnuggle.com
uzmdrmustafaalperaykanat.com
levanttradegroup.com
arcflorals.com
kinglot2499.com
freekagyans.com
region10group.gmbh
yeyelm744.com
thehomedesigncentre.com
vngc.xyz
szesdkj.com
charlottewright.online
planetgreennetwork.com
pacifica7.com
analogueadapt.com
sensorypantry.com
narbaal.com
restaurant-utopia.xyz
golnay.com
szyyglass.com
redelirevearyseuiop.xyz
goldsteelconstruction.com
discovercotswoldcottages.com
geniuseven.net
apricitee.com
stopmoshenik.online
ya2gh.com
instatechnovelz.com
dbe648.com
seifjuban.com
conquershirts.store
totalcovidtravel.com
pamperotrabajo.com
satellitphonestore.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2252-126-0x000000000041D3D0-mapping.dmp xloader behavioral2/memory/2252-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2672-133-0x0000000000780000-0x00000000007A9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
RequestLetter 11DEC.exeRequestLetter 11DEC.exechkdsk.exedescription pid process target process PID 672 set thread context of 2252 672 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 2252 set thread context of 3056 2252 RequestLetter 11DEC.exe Explorer.EXE PID 2672 set thread context of 3056 2672 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
RequestLetter 11DEC.exeRequestLetter 11DEC.exechkdsk.exepid process 672 RequestLetter 11DEC.exe 672 RequestLetter 11DEC.exe 672 RequestLetter 11DEC.exe 672 RequestLetter 11DEC.exe 2252 RequestLetter 11DEC.exe 2252 RequestLetter 11DEC.exe 2252 RequestLetter 11DEC.exe 2252 RequestLetter 11DEC.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe 2672 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3056 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RequestLetter 11DEC.exechkdsk.exepid process 2252 RequestLetter 11DEC.exe 2252 RequestLetter 11DEC.exe 2252 RequestLetter 11DEC.exe 2672 chkdsk.exe 2672 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RequestLetter 11DEC.exeRequestLetter 11DEC.exechkdsk.exedescription pid process Token: SeDebugPrivilege 672 RequestLetter 11DEC.exe Token: SeDebugPrivilege 2252 RequestLetter 11DEC.exe Token: SeDebugPrivilege 2672 chkdsk.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
RequestLetter 11DEC.exeExplorer.EXEchkdsk.exedescription pid process target process PID 672 wrote to memory of 1452 672 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 672 wrote to memory of 1452 672 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 672 wrote to memory of 1452 672 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 672 wrote to memory of 1880 672 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 672 wrote to memory of 1880 672 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 672 wrote to memory of 1880 672 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 672 wrote to memory of 2252 672 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 672 wrote to memory of 2252 672 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 672 wrote to memory of 2252 672 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 672 wrote to memory of 2252 672 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 672 wrote to memory of 2252 672 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 672 wrote to memory of 2252 672 RequestLetter 11DEC.exe RequestLetter 11DEC.exe PID 3056 wrote to memory of 2672 3056 Explorer.EXE chkdsk.exe PID 3056 wrote to memory of 2672 3056 Explorer.EXE chkdsk.exe PID 3056 wrote to memory of 2672 3056 Explorer.EXE chkdsk.exe PID 2672 wrote to memory of 2748 2672 chkdsk.exe cmd.exe PID 2672 wrote to memory of 2748 2672 chkdsk.exe cmd.exe PID 2672 wrote to memory of 2748 2672 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RequestLetter 11DEC.exe"C:\Users\Admin\AppData\Local\Temp\RequestLetter 11DEC.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RequestLetter 11DEC.exe"C:\Users\Admin\AppData\Local\Temp\RequestLetter 11DEC.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\RequestLetter 11DEC.exe"C:\Users\Admin\AppData\Local\Temp\RequestLetter 11DEC.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\RequestLetter 11DEC.exe"C:\Users\Admin\AppData\Local\Temp\RequestLetter 11DEC.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RequestLetter 11DEC.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/672-115-0x00000000007E0000-0x00000000007E1000-memory.dmpFilesize
4KB
-
memory/672-117-0x0000000005820000-0x0000000005821000-memory.dmpFilesize
4KB
-
memory/672-118-0x0000000005320000-0x0000000005321000-memory.dmpFilesize
4KB
-
memory/672-119-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/672-120-0x0000000005230000-0x0000000005231000-memory.dmpFilesize
4KB
-
memory/672-121-0x0000000005580000-0x0000000005587000-memory.dmpFilesize
28KB
-
memory/672-122-0x00000000076A0000-0x00000000076A1000-memory.dmpFilesize
4KB
-
memory/672-123-0x00000000079D0000-0x00000000079D1000-memory.dmpFilesize
4KB
-
memory/672-124-0x0000000007A70000-0x0000000007B86000-memory.dmpFilesize
1.1MB
-
memory/2252-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2252-126-0x000000000041D3D0-mapping.dmp
-
memory/2252-128-0x0000000001120000-0x0000000001440000-memory.dmpFilesize
3.1MB
-
memory/2252-129-0x00000000010D0000-0x00000000010E1000-memory.dmpFilesize
68KB
-
memory/2672-131-0x0000000000000000-mapping.dmp
-
memory/2672-132-0x0000000001290000-0x000000000129A000-memory.dmpFilesize
40KB
-
memory/2672-133-0x0000000000780000-0x00000000007A9000-memory.dmpFilesize
164KB
-
memory/2672-135-0x00000000052A0000-0x00000000055C0000-memory.dmpFilesize
3.1MB
-
memory/2672-136-0x0000000001070000-0x0000000001100000-memory.dmpFilesize
576KB
-
memory/2748-134-0x0000000000000000-mapping.dmp
-
memory/3056-130-0x0000000005C10000-0x0000000005CC7000-memory.dmpFilesize
732KB
-
memory/3056-137-0x0000000005CD0000-0x0000000005E0E000-memory.dmpFilesize
1.2MB