Analysis
-
max time kernel
74s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21/06/2022, 10:21
Static task
static1
General
-
Target
a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448.exe
-
Size
451KB
-
MD5
9e1bb80ff1f6f5181ed26c62ef3de29d
-
SHA1
5c37096275b5947dfd68ccacc92eec204fa73883
-
SHA256
a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448
-
SHA512
f1493090882bbe106508b50a0dcc8ac9966b157837f3d3d428b5b1977bcda3ea00eb067b5f925add5a38e069cfb4e7ce63be49ba8db29b23eb171290226e7004
Malware Config
Signatures
-
Xloader Payload 1 IoCs
resource yara_rule behavioral1/memory/4480-136-0x0000000000400000-0x000000000042C000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3528 set thread context of 4480 3528 a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448.exe 91 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4480 a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448.exe 4480 a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3528 wrote to memory of 4480 3528 a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448.exe 91 PID 3528 wrote to memory of 4480 3528 a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448.exe 91 PID 3528 wrote to memory of 4480 3528 a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448.exe 91 PID 3528 wrote to memory of 4480 3528 a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448.exe 91 PID 3528 wrote to memory of 4480 3528 a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448.exe 91 PID 3528 wrote to memory of 4480 3528 a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448.exe"C:\Users\Admin\AppData\Local\Temp\a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448.exe"C:\Users\Admin\AppData\Local\Temp\a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4480
-