Analysis
-
max time kernel
116s -
max time network
164s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
30-01-2022 16:05
Static task
static1
Behavioral task
behavioral1
Sample
df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe
Resource
win7-en-20211208
General
-
Target
df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe
-
Size
800KB
-
MD5
059c56876497cfe76c5fd67bb83fd8a6
-
SHA1
d0c8bcffd9a9393e02afa12d0d1d6da3f5ae5426
-
SHA256
df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4
-
SHA512
06ce3b9bb8d3c80efae131ec7c5c17168f2ca78b177e94c79b1ef3b36d8b8ab87c1da86468419017aaf34cdcf45e71a6666715014a5d3a5811194939367dfcd5
Malware Config
Extracted
xloader
2.3
kio8
greeaircondition.com
thewilmingtonguide.com
cbluedotlivewdmall.com
globalcrime24.com
heightsplace.com
ghar.pro
asosbira.com
melolandia.com
velactun.com
erniesimms.com
nutbullet.com
drizzerstr.com
hnqym888.com
ghorowaseba.com
1317efoxchasedrive.info
stjudetroop623.com
facestaj.com
airpromaskaccessories.com
wolfetailors.com
56ohdc2016.com
estedindustries.com
magmaplant.net
tf-iot.com
jtkqmz.com
helmihendrahasilbumi.com
audiencetrust.sucks
thespiritualabolitionist.com
lauratoots.com
fantasticsgelato.com
allinoncrypto.site
youremsys.com
awesome-veganism.com
tsunrp.net
systizen.com
73gardinerdrive.com
legamedary.com
newyorkcityhemorrhoidclinic.com
ffhcompany.com
angermgmtathome.com
plantationrevival.com
utopicvibes.net
envirocare-ss.com
domentemenegi20.com
gropedais.club
thaibizgermany.com
noimagreece.com
yogabizhelp.com
sanrenzong.com
bingent.info
chinhphucphaidep.online
dubojx.com
jennaloren.com
thedesigneryshop.com
opera-historica.com
pizzaterry.com
the-aviate.com
perteprampram01.net
pastormariorondon.com
dream-case.com
ocleanwholesaler.com
masdimensiones.com
fireworkstycoons.com
porntvh.com
fixedpriceelectrician.com
smallcoloradoweddings.com
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1616-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exedescription pid process target process PID 904 set thread context of 1616 904 df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exepid process 1616 df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe 1616 df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exedescription pid process target process PID 904 wrote to memory of 1616 904 df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe PID 904 wrote to memory of 1616 904 df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe PID 904 wrote to memory of 1616 904 df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe PID 904 wrote to memory of 1616 904 df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe PID 904 wrote to memory of 1616 904 df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe PID 904 wrote to memory of 1616 904 df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe"C:\Users\Admin\AppData\Local\Temp\df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe"C:\Users\Admin\AppData\Local\Temp\df52f3046504a1273cebafc03bb13ea024b81964eb78a6dbd118478a7c9ce8b4.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/904-115-0x0000000000AD0000-0x0000000000B9E000-memory.dmpFilesize
824KB
-
memory/904-116-0x0000000005570000-0x000000000560C000-memory.dmpFilesize
624KB
-
memory/904-117-0x0000000005B10000-0x000000000600E000-memory.dmpFilesize
5.0MB
-
memory/904-118-0x0000000005610000-0x00000000056A2000-memory.dmpFilesize
584KB
-
memory/904-119-0x0000000005610000-0x0000000005B0E000-memory.dmpFilesize
5.0MB
-
memory/904-120-0x00000000054F0000-0x00000000054FA000-memory.dmpFilesize
40KB
-
memory/904-121-0x0000000005870000-0x00000000058C6000-memory.dmpFilesize
344KB
-
memory/904-122-0x0000000005830000-0x0000000005858000-memory.dmpFilesize
160KB
-
memory/904-123-0x00000000063F0000-0x000000000645E000-memory.dmpFilesize
440KB
-
memory/1616-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1616-125-0x00000000010E0000-0x0000000001400000-memory.dmpFilesize
3.1MB