Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
17-01-2022 09:39
Static task
static1
Behavioral task
behavioral1
Sample
9a11096ec7f7df31e17a49b906ffe6e8.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
9a11096ec7f7df31e17a49b906ffe6e8.exe
Resource
win10v2004-en-20220113
General
-
Target
9a11096ec7f7df31e17a49b906ffe6e8.exe
-
Size
784KB
-
MD5
9a11096ec7f7df31e17a49b906ffe6e8
-
SHA1
3badde24ac2d4dbcf354e6d31d1ecf29af4f0956
-
SHA256
a1d8420052bbdcaf3d318427bfe57edf5cc330fb14aaa5f4a597fac220c2a6de
-
SHA512
b8948bbdbcc03612ed5421d849ddcec4f02e5d83267620b8c0aa9e4f3bfc2714ff424bbd5c2876e2f4b317ad15e2db016912541385b191727d78de66fb8a4278
Malware Config
Extracted
xloader
2.5
pnug
natureate.com
ita-pots.website
sucohansmushroom.com
produrielrosen.com
gosystemupdatenow.online
jiskra.art
janwiench.com
norfolkfoodhall.com
iloveaddictss.com
pogozip.com
buyinstapva.com
teardirectionfreedom.xyz
0205168.com
apaixonadosporpugs.online
jawscoinc.com
crafter.quest
wikipedianow.com
radiopuls.net
kendama-co.com
goodstudycanada.com
huzhoucs.com
asinment.com
fuchsundrudolph.com
arthurenathalia.com
globalcosmeticsstudios.com
brandrackley.com
freemanhub.one
utserver.online
fullspecter.com
wshowcase.com
airjordanshoes-retro.com
linguimatics.com
app-verlengen.icu
singpost.red
j4.claims
inoteapp.net
jrdautomotivellc.com
xn--beaupre-6xa.com
mypolicyportal.net
wdgjdhpg.com
anshulindla.com
m981070.com
vertentebike.com
claim-available.com
buyfudgybombs.com
adfnapoli.com
blackfuid.com
clambakedelivered.info
marketingworksonhold.com
xvyj.top
richardsonsfinest.com
gurimix.com
dorhop.com
mauigrowngreencoffee.net
juzytuu.xyz
pokorny.industries
floridapermitsolutions.com
right-on-target-store.com
ynaire.com
nextpar.com
disdrone.com
fruitfulvinebirth.com
africanfairytale.com
leisuresabah.com
safetyeats.asia
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1104-63-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1104-64-0x000000000041D400-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9a11096ec7f7df31e17a49b906ffe6e8.exedescription pid process target process PID 864 set thread context of 1104 864 9a11096ec7f7df31e17a49b906ffe6e8.exe 9a11096ec7f7df31e17a49b906ffe6e8.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
9a11096ec7f7df31e17a49b906ffe6e8.exepid process 1104 9a11096ec7f7df31e17a49b906ffe6e8.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
9a11096ec7f7df31e17a49b906ffe6e8.exedescription pid process target process PID 864 wrote to memory of 1104 864 9a11096ec7f7df31e17a49b906ffe6e8.exe 9a11096ec7f7df31e17a49b906ffe6e8.exe PID 864 wrote to memory of 1104 864 9a11096ec7f7df31e17a49b906ffe6e8.exe 9a11096ec7f7df31e17a49b906ffe6e8.exe PID 864 wrote to memory of 1104 864 9a11096ec7f7df31e17a49b906ffe6e8.exe 9a11096ec7f7df31e17a49b906ffe6e8.exe PID 864 wrote to memory of 1104 864 9a11096ec7f7df31e17a49b906ffe6e8.exe 9a11096ec7f7df31e17a49b906ffe6e8.exe PID 864 wrote to memory of 1104 864 9a11096ec7f7df31e17a49b906ffe6e8.exe 9a11096ec7f7df31e17a49b906ffe6e8.exe PID 864 wrote to memory of 1104 864 9a11096ec7f7df31e17a49b906ffe6e8.exe 9a11096ec7f7df31e17a49b906ffe6e8.exe PID 864 wrote to memory of 1104 864 9a11096ec7f7df31e17a49b906ffe6e8.exe 9a11096ec7f7df31e17a49b906ffe6e8.exe PID 864 wrote to memory of 1104 864 9a11096ec7f7df31e17a49b906ffe6e8.exe 9a11096ec7f7df31e17a49b906ffe6e8.exe PID 864 wrote to memory of 1104 864 9a11096ec7f7df31e17a49b906ffe6e8.exe 9a11096ec7f7df31e17a49b906ffe6e8.exe PID 864 wrote to memory of 1104 864 9a11096ec7f7df31e17a49b906ffe6e8.exe 9a11096ec7f7df31e17a49b906ffe6e8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a11096ec7f7df31e17a49b906ffe6e8.exe"C:\Users\Admin\AppData\Local\Temp\9a11096ec7f7df31e17a49b906ffe6e8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\9a11096ec7f7df31e17a49b906ffe6e8.exe"C:\Users\Admin\AppData\Local\Temp\9a11096ec7f7df31e17a49b906ffe6e8.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1104
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/864-55-0x0000000000270000-0x000000000033A000-memory.dmpFilesize
808KB
-
memory/864-56-0x0000000000270000-0x000000000033A000-memory.dmpFilesize
808KB
-
memory/864-57-0x0000000075421000-0x0000000075423000-memory.dmpFilesize
8KB
-
memory/864-58-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/864-59-0x0000000000360000-0x0000000000370000-memory.dmpFilesize
64KB
-
memory/864-60-0x0000000004E00000-0x0000000004E5E000-memory.dmpFilesize
376KB
-
memory/1104-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1104-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1104-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1104-64-0x000000000041D400-mapping.dmp
-
memory/1104-65-0x00000000009B0000-0x0000000000CB3000-memory.dmpFilesize
3.0MB