Analysis
-
max time kernel
54s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-07-2022 18:38
Static task
static1
Behavioral task
behavioral1
Sample
6adcad993626f90d1efcbb797c6fc63f.exe
Resource
win7-20220414-en
General
-
Target
6adcad993626f90d1efcbb797c6fc63f.exe
-
Size
629KB
-
MD5
6adcad993626f90d1efcbb797c6fc63f
-
SHA1
7a98b02cf27bb92ff397de5b5554ab17426edfe9
-
SHA256
35ddf428695769bb87459e0848cfae7eb62a86c91c8bb33a2caa23c5fbc43b73
-
SHA512
9cf09f841b0f56be7590af0ea43b145df5ba8e20d31ca2fefe234ae1a2ceba5f4a1f950468a566d970a13516172aa3275e39399179e2f0e78b79bf38bbe50015
Malware Config
Extracted
xloader
2.8
nn40
LYAg0yANOGEAGeaFOrA/
MQWuERZplP+VZy/uszI=
CF0oDN0JimIaGy/uszI=
ltJnyC+ReohYaiTvj1qbEA==
B9OkgdctVKBAFjSUaw==
sbDVwSZVVqVB11/deow8GA==
v1gHDe0pzno=
i+/0n2vHUfGPR98k77tukZ90MQ==
SUtCnbS96Qm21g==
8X9qzyt1dpAo31jXrXfKb49fBPY=
5KlPxqHzSstuFjSUaw==
0r/Kesv/zuanroxvNQW0Gm8=
FFgS7kfPYAqpdhhgRgnBJHY=
LgusAHrkrIoWr0FWIe2o/04UXPw=
vBq9Gvxa9wbKbS/uszI=
Z+q6HAZNNeqwwQ==
wbS4fMb06SjU5Kbseow8GA==
1mZEuZvJ/m0L9bof56PkkZ90MQ==
JCJIM74lHk/o+tiFOrA/
d14FrM8rGEgIzVkT67+3XaEh
OtJqJTaZyD/bgy/uszI=
MMzqpo3pVjbaigine/p4W6dqZPJKkg==
LRS4MpnBeVxC/bqjf0kMBGop69QC
7FTxgWaTLAKbm3B0QgW0Gm8=
hjbYktAyum2JNK6N
WRtxyNlENeqwwQ==
MTOKH+0pzno=
8LkJ8EsWWHIK
zs758oMTaffAxI0bn2uqFw==
ariAXDqMsKpwF5U=
UEZOAmXFnpRh+rqD
T5e5xzlTNeqwwQ==
tp424+UDomI=
Y7VXD+I8CKVuDZQ=
zg6qeGbHO1F+FjSUaw==
JPypEB2CuDAz+bXSrjo=
8ah8cf5odcPNS+Sa
k+CGNhyOMKVuDZQ=
oVviitkD8B7ZmijeyIDFOI9nZPJKkg==
TtztqHfKKqQWuVRvT9fSSpJJmAFYLjw=
p6pvJHfZmJgx6XwYuL56b798MA==
WWmegczy4x2O+cIC27RtkZ90MQ==
/QrLiDyde3RJWRwRmWYo
PtShJAZG1WU6LP3osjo=
ZTrOf2PMho1kdm/JtSU=
A1ssC+pS8dvNS+Sa
K4g38tVda8DNS+Sa
Dz7fj13DnKh1iV8++X2H8Fbeq1jBGh4D
0AjPwNQtnWUEpDBAJbq9GG8p69QC
ALhKrIu7/5BTRf1OQAW0Gm8=
a5Zp3GrGWhzmrBYRmWYo
dwzcQzpnYYAi8G7eypfSS6d3oWmQnQ==
VR3AHfcDyG79m6bm0YnEOEBS/fQ=
pyZFKiWXNaVuDZQ=
dzf0zzBlYaqLFjSUaw==
D6TIj16hJ8JhJMom8rlxkZ90MQ==
8qkyvpp56Qm21g==
4qNmKHymVg3Bx4M=
MOiH6DRYhutyFjSUaw==
JqTDnm+zOQLV+83Ucm9GDw==
YQilIAQqUM5vFjSUaw==
84U/nbvTQwzcyQ==
mC34kB9LdeJuFjSUaw==
DKLKrbwuuWyJNK6N
thisismyhomevalue.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2020-65-0x000000000041F640-mapping.dmp xloader behavioral1/memory/2020-64-0x0000000000400000-0x000000000042C000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6adcad993626f90d1efcbb797c6fc63f.exedescription pid process target process PID 1540 set thread context of 2020 1540 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
6adcad993626f90d1efcbb797c6fc63f.exepid process 2020 6adcad993626f90d1efcbb797c6fc63f.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
6adcad993626f90d1efcbb797c6fc63f.exedescription pid process target process PID 1540 wrote to memory of 2020 1540 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe PID 1540 wrote to memory of 2020 1540 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe PID 1540 wrote to memory of 2020 1540 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe PID 1540 wrote to memory of 2020 1540 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe PID 1540 wrote to memory of 2020 1540 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe PID 1540 wrote to memory of 2020 1540 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe PID 1540 wrote to memory of 2020 1540 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6adcad993626f90d1efcbb797c6fc63f.exe"C:\Users\Admin\AppData\Local\Temp\6adcad993626f90d1efcbb797c6fc63f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6adcad993626f90d1efcbb797c6fc63f.exe"C:\Users\Admin\AppData\Local\Temp\6adcad993626f90d1efcbb797c6fc63f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1540-54-0x0000000000F30000-0x0000000000FD2000-memory.dmpFilesize
648KB
-
memory/1540-55-0x0000000074B51000-0x0000000074B53000-memory.dmpFilesize
8KB
-
memory/1540-56-0x0000000000CB0000-0x0000000000D34000-memory.dmpFilesize
528KB
-
memory/1540-57-0x00000000008E0000-0x0000000000900000-memory.dmpFilesize
128KB
-
memory/1540-58-0x0000000000A40000-0x0000000000A4E000-memory.dmpFilesize
56KB
-
memory/1540-59-0x0000000005F40000-0x0000000005FB6000-memory.dmpFilesize
472KB
-
memory/1540-60-0x0000000004C30000-0x0000000004C62000-memory.dmpFilesize
200KB
-
memory/2020-61-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2020-62-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2020-65-0x000000000041F640-mapping.dmp
-
memory/2020-64-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2020-66-0x0000000000970000-0x0000000000C73000-memory.dmpFilesize
3.0MB