Analysis
-
max time kernel
112s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
25-01-2022 10:56
Static task
static1
Behavioral task
behavioral1
Sample
d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe
Resource
win10v2004-en-20220112
General
-
Target
d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe
-
Size
1.1MB
-
MD5
e28fd2c13a6bc4dbc7b7836fcb1b224e
-
SHA1
0b68827fbf894303055c9565abdeb85c5fa08b4d
-
SHA256
d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c
-
SHA512
1b407de96390a32a8a050265fc47e1289d16c89f08cac0eb116f7fd3ba6a8644c1b80cd4a50fd14a66dcfc9fedbda3ed2c54969f94272b3d7963c4e3f2f36022
Malware Config
Extracted
xloader
2.5
pnug
natureate.com
ita-pots.website
sucohansmushroom.com
produrielrosen.com
gosystemupdatenow.online
jiskra.art
janwiench.com
norfolkfoodhall.com
iloveaddictss.com
pogozip.com
buyinstapva.com
teardirectionfreedom.xyz
0205168.com
apaixonadosporpugs.online
jawscoinc.com
crafter.quest
wikipedianow.com
radiopuls.net
kendama-co.com
goodstudycanada.com
huzhoucs.com
asinment.com
fuchsundrudolph.com
arthurenathalia.com
globalcosmeticsstudios.com
brandrackley.com
freemanhub.one
utserver.online
fullspecter.com
wshowcase.com
airjordanshoes-retro.com
linguimatics.com
app-verlengen.icu
singpost.red
j4.claims
inoteapp.net
jrdautomotivellc.com
xn--beaupre-6xa.com
mypolicyportal.net
wdgjdhpg.com
anshulindla.com
m981070.com
vertentebike.com
claim-available.com
buyfudgybombs.com
adfnapoli.com
blackfuid.com
clambakedelivered.info
marketingworksonhold.com
xvyj.top
richardsonsfinest.com
gurimix.com
dorhop.com
mauigrowngreencoffee.net
juzytuu.xyz
pokorny.industries
floridapermitsolutions.com
right-on-target-store.com
ynaire.com
nextpar.com
disdrone.com
fruitfulvinebirth.com
africanfairytale.com
leisuresabah.com
safetyeats.asia
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1444-310-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exedescription pid process target process PID 3244 set thread context of 1444 3244 d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exepid process 1444 d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe 1444 d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exedescription pid process target process PID 3244 wrote to memory of 1444 3244 d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe PID 3244 wrote to memory of 1444 3244 d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe PID 3244 wrote to memory of 1444 3244 d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe PID 3244 wrote to memory of 1444 3244 d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe PID 3244 wrote to memory of 1444 3244 d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe PID 3244 wrote to memory of 1444 3244 d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe"C:\Users\Admin\AppData\Local\Temp\d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe"C:\Users\Admin\AppData\Local\Temp\d2c9827978276132cc38a69bb87dbf7ab682d04d194271f460f3bd14d76f9c2c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1444
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 0491c988fbb479ab41ce120a8e965588 /fHnhOTCGk2FIQ1skF4/hw.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:3804
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1444-310-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3244-133-0x0000000000310000-0x0000000000424000-memory.dmpFilesize
1.1MB
-
memory/3244-134-0x0000000005400000-0x00000000059A4000-memory.dmpFilesize
5.6MB
-
memory/3244-135-0x0000000004E50000-0x0000000004EE2000-memory.dmpFilesize
584KB
-
memory/3244-136-0x0000000004DD0000-0x0000000004DDA000-memory.dmpFilesize
40KB
-
memory/3244-137-0x00000000050F0000-0x000000000518C000-memory.dmpFilesize
624KB
-
memory/3244-138-0x0000000004E10000-0x0000000004E11000-memory.dmpFilesize
4KB
-
memory/3244-139-0x000000007F5E0000-0x000000007F5E1000-memory.dmpFilesize
4KB