Analysis
-
max time kernel
117s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
13-01-2022 13:34
Static task
static1
General
-
Target
a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe
-
Size
582KB
-
MD5
0e99d13aafcc5e8fadc45d8b85336d9b
-
SHA1
6573c9dd229e50981aa24128ad02a07e99805369
-
SHA256
a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f
-
SHA512
d2c22cff7ad0e8ea73b4d6a82f732d5d4f10033598040d545f00711d5a9c10c2d78e5c5aa17c8cacf9434e361f4b947a33c4849e800e2f3df7b73245ecd69d5a
Malware Config
Extracted
xloader
2.5
pnug
natureate.com
ita-pots.website
sucohansmushroom.com
produrielrosen.com
gosystemupdatenow.online
jiskra.art
janwiench.com
norfolkfoodhall.com
iloveaddictss.com
pogozip.com
buyinstapva.com
teardirectionfreedom.xyz
0205168.com
apaixonadosporpugs.online
jawscoinc.com
crafter.quest
wikipedianow.com
radiopuls.net
kendama-co.com
goodstudycanada.com
huzhoucs.com
asinment.com
fuchsundrudolph.com
arthurenathalia.com
globalcosmeticsstudios.com
brandrackley.com
freemanhub.one
utserver.online
fullspecter.com
wshowcase.com
airjordanshoes-retro.com
linguimatics.com
app-verlengen.icu
singpost.red
j4.claims
inoteapp.net
jrdautomotivellc.com
xn--beaupre-6xa.com
mypolicyportal.net
wdgjdhpg.com
anshulindla.com
m981070.com
vertentebike.com
claim-available.com
buyfudgybombs.com
adfnapoli.com
blackfuid.com
clambakedelivered.info
marketingworksonhold.com
xvyj.top
richardsonsfinest.com
gurimix.com
dorhop.com
mauigrowngreencoffee.net
juzytuu.xyz
pokorny.industries
floridapermitsolutions.com
right-on-target-store.com
ynaire.com
nextpar.com
disdrone.com
fruitfulvinebirth.com
africanfairytale.com
leisuresabah.com
safetyeats.asia
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3748-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/3748-126-0x000000000041D400-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exedescription pid process target process PID 2448 set thread context of 3748 2448 a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exea15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exepid process 2448 a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe 2448 a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe 3748 a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe 3748 a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exedescription pid process Token: SeDebugPrivilege 2448 a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exedescription pid process target process PID 2448 wrote to memory of 1608 2448 a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe PID 2448 wrote to memory of 1608 2448 a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe PID 2448 wrote to memory of 1608 2448 a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe PID 2448 wrote to memory of 3748 2448 a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe PID 2448 wrote to memory of 3748 2448 a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe PID 2448 wrote to memory of 3748 2448 a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe PID 2448 wrote to memory of 3748 2448 a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe PID 2448 wrote to memory of 3748 2448 a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe PID 2448 wrote to memory of 3748 2448 a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe"C:\Users\Admin\AppData\Local\Temp\a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe"C:\Users\Admin\AppData\Local\Temp\a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe"C:\Users\Admin\AppData\Local\Temp\a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2448-115-0x0000000000690000-0x0000000000728000-memory.dmpFilesize
608KB
-
memory/2448-116-0x0000000000690000-0x0000000000728000-memory.dmpFilesize
608KB
-
memory/2448-117-0x0000000005680000-0x0000000005B7E000-memory.dmpFilesize
5.0MB
-
memory/2448-118-0x00000000050A0000-0x0000000005132000-memory.dmpFilesize
584KB
-
memory/2448-119-0x0000000005000000-0x0000000005092000-memory.dmpFilesize
584KB
-
memory/2448-120-0x0000000005150000-0x000000000515A000-memory.dmpFilesize
40KB
-
memory/2448-121-0x0000000005340000-0x00000000053DC000-memory.dmpFilesize
624KB
-
memory/2448-122-0x0000000005660000-0x000000000566E000-memory.dmpFilesize
56KB
-
memory/2448-123-0x00000000086D0000-0x000000000871B000-memory.dmpFilesize
300KB
-
memory/2448-124-0x0000000008B00000-0x0000000008B5E000-memory.dmpFilesize
376KB
-
memory/3748-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3748-126-0x000000000041D400-mapping.dmp
-
memory/3748-127-0x0000000000F00000-0x0000000001220000-memory.dmpFilesize
3.1MB