Analysis
-
max time kernel
122s -
max time network
146s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 20:15
Static task
static1
Behavioral task
behavioral1
Sample
328bee37fcb028ff0d8b6b2c406b3b4e.exe
Resource
win7-en-20211208
General
-
Target
328bee37fcb028ff0d8b6b2c406b3b4e.exe
-
Size
814KB
-
MD5
328bee37fcb028ff0d8b6b2c406b3b4e
-
SHA1
be9254a60f0301a22c6ab708b3829c2d61f21adb
-
SHA256
11e5030403c99dfa27a1c41a8a3abf2408324166735b081a7db038c9a3ec357d
-
SHA512
87677e6eb40a4163e2c23d500664d1bbc5502393de8db774ad1568b70e3f360c258a815db2665b61fabac9afb1e357b32f10af4ccc2cdc68f115d1eea2495aca
Malware Config
Extracted
xloader
2.5
pnug
natureate.com
ita-pots.website
sucohansmushroom.com
produrielrosen.com
gosystemupdatenow.online
jiskra.art
janwiench.com
norfolkfoodhall.com
iloveaddictss.com
pogozip.com
buyinstapva.com
teardirectionfreedom.xyz
0205168.com
apaixonadosporpugs.online
jawscoinc.com
crafter.quest
wikipedianow.com
radiopuls.net
kendama-co.com
goodstudycanada.com
huzhoucs.com
asinment.com
fuchsundrudolph.com
arthurenathalia.com
globalcosmeticsstudios.com
brandrackley.com
freemanhub.one
utserver.online
fullspecter.com
wshowcase.com
airjordanshoes-retro.com
linguimatics.com
app-verlengen.icu
singpost.red
j4.claims
inoteapp.net
jrdautomotivellc.com
xn--beaupre-6xa.com
mypolicyportal.net
wdgjdhpg.com
anshulindla.com
m981070.com
vertentebike.com
claim-available.com
buyfudgybombs.com
adfnapoli.com
blackfuid.com
clambakedelivered.info
marketingworksonhold.com
xvyj.top
richardsonsfinest.com
gurimix.com
dorhop.com
mauigrowngreencoffee.net
juzytuu.xyz
pokorny.industries
floridapermitsolutions.com
right-on-target-store.com
ynaire.com
nextpar.com
disdrone.com
fruitfulvinebirth.com
africanfairytale.com
leisuresabah.com
safetyeats.asia
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4348-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
328bee37fcb028ff0d8b6b2c406b3b4e.exedescription pid process target process PID 3436 set thread context of 4348 3436 328bee37fcb028ff0d8b6b2c406b3b4e.exe 328bee37fcb028ff0d8b6b2c406b3b4e.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
328bee37fcb028ff0d8b6b2c406b3b4e.exe328bee37fcb028ff0d8b6b2c406b3b4e.exepid process 3436 328bee37fcb028ff0d8b6b2c406b3b4e.exe 3436 328bee37fcb028ff0d8b6b2c406b3b4e.exe 4348 328bee37fcb028ff0d8b6b2c406b3b4e.exe 4348 328bee37fcb028ff0d8b6b2c406b3b4e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
328bee37fcb028ff0d8b6b2c406b3b4e.exedescription pid process Token: SeDebugPrivilege 3436 328bee37fcb028ff0d8b6b2c406b3b4e.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
328bee37fcb028ff0d8b6b2c406b3b4e.exedescription pid process target process PID 3436 wrote to memory of 4248 3436 328bee37fcb028ff0d8b6b2c406b3b4e.exe 328bee37fcb028ff0d8b6b2c406b3b4e.exe PID 3436 wrote to memory of 4248 3436 328bee37fcb028ff0d8b6b2c406b3b4e.exe 328bee37fcb028ff0d8b6b2c406b3b4e.exe PID 3436 wrote to memory of 4248 3436 328bee37fcb028ff0d8b6b2c406b3b4e.exe 328bee37fcb028ff0d8b6b2c406b3b4e.exe PID 3436 wrote to memory of 4348 3436 328bee37fcb028ff0d8b6b2c406b3b4e.exe 328bee37fcb028ff0d8b6b2c406b3b4e.exe PID 3436 wrote to memory of 4348 3436 328bee37fcb028ff0d8b6b2c406b3b4e.exe 328bee37fcb028ff0d8b6b2c406b3b4e.exe PID 3436 wrote to memory of 4348 3436 328bee37fcb028ff0d8b6b2c406b3b4e.exe 328bee37fcb028ff0d8b6b2c406b3b4e.exe PID 3436 wrote to memory of 4348 3436 328bee37fcb028ff0d8b6b2c406b3b4e.exe 328bee37fcb028ff0d8b6b2c406b3b4e.exe PID 3436 wrote to memory of 4348 3436 328bee37fcb028ff0d8b6b2c406b3b4e.exe 328bee37fcb028ff0d8b6b2c406b3b4e.exe PID 3436 wrote to memory of 4348 3436 328bee37fcb028ff0d8b6b2c406b3b4e.exe 328bee37fcb028ff0d8b6b2c406b3b4e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\328bee37fcb028ff0d8b6b2c406b3b4e.exe"C:\Users\Admin\AppData\Local\Temp\328bee37fcb028ff0d8b6b2c406b3b4e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\328bee37fcb028ff0d8b6b2c406b3b4e.exe"C:\Users\Admin\AppData\Local\Temp\328bee37fcb028ff0d8b6b2c406b3b4e.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\328bee37fcb028ff0d8b6b2c406b3b4e.exe"C:\Users\Admin\AppData\Local\Temp\328bee37fcb028ff0d8b6b2c406b3b4e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3436-115-0x0000000000320000-0x00000000003F2000-memory.dmpFilesize
840KB
-
memory/3436-116-0x0000000005080000-0x000000000557E000-memory.dmpFilesize
5.0MB
-
memory/3436-117-0x0000000004C40000-0x0000000004CD2000-memory.dmpFilesize
584KB
-
memory/3436-118-0x0000000004B80000-0x000000000507E000-memory.dmpFilesize
5.0MB
-
memory/3436-119-0x0000000004CE0000-0x0000000004CEA000-memory.dmpFilesize
40KB
-
memory/3436-120-0x00000000070E0000-0x000000000717C000-memory.dmpFilesize
624KB
-
memory/3436-121-0x0000000005750000-0x000000000575C000-memory.dmpFilesize
48KB
-
memory/3436-122-0x000000007F930000-0x000000007F931000-memory.dmpFilesize
4KB
-
memory/3436-123-0x0000000007320000-0x0000000007388000-memory.dmpFilesize
416KB
-
memory/4348-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4348-125-0x0000000001740000-0x0000000001A60000-memory.dmpFilesize
3.1MB