General
-
Target
Drawing.exe
-
Size
632KB
-
Sample
220121-f4wm9sdhc2
-
MD5
6a5da7edb320b2ba8635683b53db2ccb
-
SHA1
38c006c6a2dfa2c238d339151670b0e382863961
-
SHA256
89c9a52351f75b5be88f745b84dbb5c16930cca9d932f33b008993167e022e70
-
SHA512
d20fbde572c9b217094f61718047d1446f9a39dbf9a564be8cde728b4b9f6d7ae8f777e017f7061b8b0663eb6d07b4b12c269f9fb17c223c8d2708a466c5f9f9
Static task
static1
Behavioral task
behavioral1
Sample
Drawing.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Drawing.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
xloader
2.5
rexd
xn--2es77o3w1bruk.mobi
cotesaintetienne.com
newlifefoursquaremcpherson.com
solutions-consulting.biz
chsico.com
demeet.xyz
eiruhguijire.store
realestatemoda.com
amr-fire.net
99v.one
altdaita.com
showerbeast.com
nsfone.com
doanhnhanvietnam.info
xn--transfpanou-39a.com
invitiz.com
chifaebio.xyz
footprint-farm.com
onlinenurseprograms.com
tigeratlspa.com
troublewatermelon.space
juvesti.com
hunnii.one
collective4choice.com
casino-mate1.com
hairandspa-aimer-kadsume.com
pointconstructionservices.com
savagereviews.xyz
zhuangmengmeng.com
gicaredocs.com
victori-jaya.com
purifilt.net
live9words.com
x-teknoloji.com
thelocalworkers.com
nalainteriores.com
dream-mart.tech
maretta.info
empowermindbodystudios.com
creativenft.xyz
remembertheabbeygate.com
whistlergardencenter.com
jbmfg.net
tangerinecave.com
60thstreetdesserts.com
mxcpgj.com
nguoidantocvungcao.xyz
snowjamproductiosmedia.com
schencklab.com
sousouhenansheng.com
quirkysoul39.com
digitaleclipsegames.com
hayesvalleycondo409.com
ceremonydesigncompany.com
essaispsoriasisenfants-ca.com
borhanmarket.com
aerbounce.com
primebradescocadastro.com
bupis44.info
optmsg.com
khukhuanphongkham.com
bunnymoorellc.com
tminus-10.com
mytechmadesimple.com
loj-kits.xyz
Targets
-
-
Target
Drawing.exe
-
Size
632KB
-
MD5
6a5da7edb320b2ba8635683b53db2ccb
-
SHA1
38c006c6a2dfa2c238d339151670b0e382863961
-
SHA256
89c9a52351f75b5be88f745b84dbb5c16930cca9d932f33b008993167e022e70
-
SHA512
d20fbde572c9b217094f61718047d1446f9a39dbf9a564be8cde728b4b9f6d7ae8f777e017f7061b8b0663eb6d07b4b12c269f9fb17c223c8d2708a466c5f9f9
Score10/10-
Xloader Payload
-
Sets service image path in registry
-
Deletes itself
-
Suspicious use of SetThreadContext
-