Analysis
-
max time kernel
42s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
28-06-2022 09:30
Static task
static1
Behavioral task
behavioral1
Sample
e32e254b685cd1709f4ef86b5441d84e.exe
Resource
win7-20220414-en
General
-
Target
e32e254b685cd1709f4ef86b5441d84e.exe
-
Size
635KB
-
MD5
e32e254b685cd1709f4ef86b5441d84e
-
SHA1
55d4645e42f4104229ced1fff95532ee7bd6632a
-
SHA256
0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e
-
SHA512
4e01d48e6827da547c27b3f6063ec87537d98532b7a2c81e37a8531abe664a3c5bef2629292be1c12c7da8a1a0a100f64b007869c34e3951026fa2f9af25419d
Malware Config
Extracted
xloader
2.8
nn40
LYAg0yANOGEAGeaFOrA/
MQWuERZplP+VZy/uszI=
CF0oDN0JimIaGy/uszI=
ltJnyC+ReohYaiTvj1qbEA==
B9OkgdctVKBAFjSUaw==
sbDVwSZVVqVB11/deow8GA==
v1gHDe0pzno=
i+/0n2vHUfGPR98k77tukZ90MQ==
SUtCnbS96Qm21g==
8X9qzyt1dpAo31jXrXfKb49fBPY=
5KlPxqHzSstuFjSUaw==
0r/Kesv/zuanroxvNQW0Gm8=
FFgS7kfPYAqpdhhgRgnBJHY=
LgusAHrkrIoWr0FWIe2o/04UXPw=
vBq9Gvxa9wbKbS/uszI=
Z+q6HAZNNeqwwQ==
wbS4fMb06SjU5Kbseow8GA==
1mZEuZvJ/m0L9bof56PkkZ90MQ==
JCJIM74lHk/o+tiFOrA/
d14FrM8rGEgIzVkT67+3XaEh
OtJqJTaZyD/bgy/uszI=
MMzqpo3pVjbaigine/p4W6dqZPJKkg==
LRS4MpnBeVxC/bqjf0kMBGop69QC
7FTxgWaTLAKbm3B0QgW0Gm8=
hjbYktAyum2JNK6N
WRtxyNlENeqwwQ==
MTOKH+0pzno=
8LkJ8EsWWHIK
zs758oMTaffAxI0bn2uqFw==
ariAXDqMsKpwF5U=
UEZOAmXFnpRh+rqD
T5e5xzlTNeqwwQ==
tp424+UDomI=
Y7VXD+I8CKVuDZQ=
zg6qeGbHO1F+FjSUaw==
JPypEB2CuDAz+bXSrjo=
8ah8cf5odcPNS+Sa
k+CGNhyOMKVuDZQ=
oVviitkD8B7ZmijeyIDFOI9nZPJKkg==
TtztqHfKKqQWuVRvT9fSSpJJmAFYLjw=
p6pvJHfZmJgx6XwYuL56b798MA==
WWmegczy4x2O+cIC27RtkZ90MQ==
/QrLiDyde3RJWRwRmWYo
PtShJAZG1WU6LP3osjo=
ZTrOf2PMho1kdm/JtSU=
A1ssC+pS8dvNS+Sa
K4g38tVda8DNS+Sa
Dz7fj13DnKh1iV8++X2H8Fbeq1jBGh4D
0AjPwNQtnWUEpDBAJbq9GG8p69QC
ALhKrIu7/5BTRf1OQAW0Gm8=
a5Zp3GrGWhzmrBYRmWYo
dwzcQzpnYYAi8G7eypfSS6d3oWmQnQ==
VR3AHfcDyG79m6bm0YnEOEBS/fQ=
pyZFKiWXNaVuDZQ=
dzf0zzBlYaqLFjSUaw==
D6TIj16hJ8JhJMom8rlxkZ90MQ==
8qkyvpp56Qm21g==
4qNmKHymVg3Bx4M=
MOiH6DRYhutyFjSUaw==
JqTDnm+zOQLV+83Ucm9GDw==
YQilIAQqUM5vFjSUaw==
84U/nbvTQwzcyQ==
mC34kB9LdeJuFjSUaw==
DKLKrbwuuWyJNK6N
thisismyhomevalue.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1612-63-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/1612-64-0x000000000041F640-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e32e254b685cd1709f4ef86b5441d84e.exedescription pid process target process PID 1996 set thread context of 1612 1996 e32e254b685cd1709f4ef86b5441d84e.exe e32e254b685cd1709f4ef86b5441d84e.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
e32e254b685cd1709f4ef86b5441d84e.exepid process 1612 e32e254b685cd1709f4ef86b5441d84e.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
e32e254b685cd1709f4ef86b5441d84e.exedescription pid process target process PID 1996 wrote to memory of 1612 1996 e32e254b685cd1709f4ef86b5441d84e.exe e32e254b685cd1709f4ef86b5441d84e.exe PID 1996 wrote to memory of 1612 1996 e32e254b685cd1709f4ef86b5441d84e.exe e32e254b685cd1709f4ef86b5441d84e.exe PID 1996 wrote to memory of 1612 1996 e32e254b685cd1709f4ef86b5441d84e.exe e32e254b685cd1709f4ef86b5441d84e.exe PID 1996 wrote to memory of 1612 1996 e32e254b685cd1709f4ef86b5441d84e.exe e32e254b685cd1709f4ef86b5441d84e.exe PID 1996 wrote to memory of 1612 1996 e32e254b685cd1709f4ef86b5441d84e.exe e32e254b685cd1709f4ef86b5441d84e.exe PID 1996 wrote to memory of 1612 1996 e32e254b685cd1709f4ef86b5441d84e.exe e32e254b685cd1709f4ef86b5441d84e.exe PID 1996 wrote to memory of 1612 1996 e32e254b685cd1709f4ef86b5441d84e.exe e32e254b685cd1709f4ef86b5441d84e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e32e254b685cd1709f4ef86b5441d84e.exe"C:\Users\Admin\AppData\Local\Temp\e32e254b685cd1709f4ef86b5441d84e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e32e254b685cd1709f4ef86b5441d84e.exe"C:\Users\Admin\AppData\Local\Temp\e32e254b685cd1709f4ef86b5441d84e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1612-60-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1612-61-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1612-63-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1612-64-0x000000000041F640-mapping.dmp
-
memory/1612-65-0x0000000000B50000-0x0000000000E53000-memory.dmpFilesize
3.0MB
-
memory/1996-54-0x0000000000230000-0x00000000002D6000-memory.dmpFilesize
664KB
-
memory/1996-55-0x0000000075841000-0x0000000075843000-memory.dmpFilesize
8KB
-
memory/1996-56-0x00000000004D0000-0x00000000004E6000-memory.dmpFilesize
88KB
-
memory/1996-57-0x00000000004F0000-0x00000000004FA000-memory.dmpFilesize
40KB
-
memory/1996-58-0x0000000007510000-0x000000000757A000-memory.dmpFilesize
424KB
-
memory/1996-59-0x0000000007160000-0x0000000007192000-memory.dmpFilesize
200KB