Analysis
-
max time kernel
83s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-07-2022 18:38
Static task
static1
Behavioral task
behavioral1
Sample
6adcad993626f90d1efcbb797c6fc63f.exe
Resource
win7-20220414-en
General
-
Target
6adcad993626f90d1efcbb797c6fc63f.exe
-
Size
629KB
-
MD5
6adcad993626f90d1efcbb797c6fc63f
-
SHA1
7a98b02cf27bb92ff397de5b5554ab17426edfe9
-
SHA256
35ddf428695769bb87459e0848cfae7eb62a86c91c8bb33a2caa23c5fbc43b73
-
SHA512
9cf09f841b0f56be7590af0ea43b145df5ba8e20d31ca2fefe234ae1a2ceba5f4a1f950468a566d970a13516172aa3275e39399179e2f0e78b79bf38bbe50015
Malware Config
Extracted
xloader
2.8
nn40
LYAg0yANOGEAGeaFOrA/
MQWuERZplP+VZy/uszI=
CF0oDN0JimIaGy/uszI=
ltJnyC+ReohYaiTvj1qbEA==
B9OkgdctVKBAFjSUaw==
sbDVwSZVVqVB11/deow8GA==
v1gHDe0pzno=
i+/0n2vHUfGPR98k77tukZ90MQ==
SUtCnbS96Qm21g==
8X9qzyt1dpAo31jXrXfKb49fBPY=
5KlPxqHzSstuFjSUaw==
0r/Kesv/zuanroxvNQW0Gm8=
FFgS7kfPYAqpdhhgRgnBJHY=
LgusAHrkrIoWr0FWIe2o/04UXPw=
vBq9Gvxa9wbKbS/uszI=
Z+q6HAZNNeqwwQ==
wbS4fMb06SjU5Kbseow8GA==
1mZEuZvJ/m0L9bof56PkkZ90MQ==
JCJIM74lHk/o+tiFOrA/
d14FrM8rGEgIzVkT67+3XaEh
OtJqJTaZyD/bgy/uszI=
MMzqpo3pVjbaigine/p4W6dqZPJKkg==
LRS4MpnBeVxC/bqjf0kMBGop69QC
7FTxgWaTLAKbm3B0QgW0Gm8=
hjbYktAyum2JNK6N
WRtxyNlENeqwwQ==
MTOKH+0pzno=
8LkJ8EsWWHIK
zs758oMTaffAxI0bn2uqFw==
ariAXDqMsKpwF5U=
UEZOAmXFnpRh+rqD
T5e5xzlTNeqwwQ==
tp424+UDomI=
Y7VXD+I8CKVuDZQ=
zg6qeGbHO1F+FjSUaw==
JPypEB2CuDAz+bXSrjo=
8ah8cf5odcPNS+Sa
k+CGNhyOMKVuDZQ=
oVviitkD8B7ZmijeyIDFOI9nZPJKkg==
TtztqHfKKqQWuVRvT9fSSpJJmAFYLjw=
p6pvJHfZmJgx6XwYuL56b798MA==
WWmegczy4x2O+cIC27RtkZ90MQ==
/QrLiDyde3RJWRwRmWYo
PtShJAZG1WU6LP3osjo=
ZTrOf2PMho1kdm/JtSU=
A1ssC+pS8dvNS+Sa
K4g38tVda8DNS+Sa
Dz7fj13DnKh1iV8++X2H8Fbeq1jBGh4D
0AjPwNQtnWUEpDBAJbq9GG8p69QC
ALhKrIu7/5BTRf1OQAW0Gm8=
a5Zp3GrGWhzmrBYRmWYo
dwzcQzpnYYAi8G7eypfSS6d3oWmQnQ==
VR3AHfcDyG79m6bm0YnEOEBS/fQ=
pyZFKiWXNaVuDZQ=
dzf0zzBlYaqLFjSUaw==
D6TIj16hJ8JhJMom8rlxkZ90MQ==
8qkyvpp56Qm21g==
4qNmKHymVg3Bx4M=
MOiH6DRYhutyFjSUaw==
JqTDnm+zOQLV+83Ucm9GDw==
YQilIAQqUM5vFjSUaw==
84U/nbvTQwzcyQ==
mC34kB9LdeJuFjSUaw==
DKLKrbwuuWyJNK6N
thisismyhomevalue.com
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3544-139-0x0000000000400000-0x000000000042C000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6adcad993626f90d1efcbb797c6fc63f.exedescription pid process target process PID 1876 set thread context of 3544 1876 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
6adcad993626f90d1efcbb797c6fc63f.exe6adcad993626f90d1efcbb797c6fc63f.exepid process 1876 6adcad993626f90d1efcbb797c6fc63f.exe 1876 6adcad993626f90d1efcbb797c6fc63f.exe 1876 6adcad993626f90d1efcbb797c6fc63f.exe 1876 6adcad993626f90d1efcbb797c6fc63f.exe 3544 6adcad993626f90d1efcbb797c6fc63f.exe 3544 6adcad993626f90d1efcbb797c6fc63f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6adcad993626f90d1efcbb797c6fc63f.exedescription pid process Token: SeDebugPrivilege 1876 6adcad993626f90d1efcbb797c6fc63f.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
6adcad993626f90d1efcbb797c6fc63f.exedescription pid process target process PID 1876 wrote to memory of 4856 1876 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe PID 1876 wrote to memory of 4856 1876 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe PID 1876 wrote to memory of 4856 1876 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe PID 1876 wrote to memory of 4188 1876 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe PID 1876 wrote to memory of 4188 1876 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe PID 1876 wrote to memory of 4188 1876 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe PID 1876 wrote to memory of 3544 1876 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe PID 1876 wrote to memory of 3544 1876 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe PID 1876 wrote to memory of 3544 1876 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe PID 1876 wrote to memory of 3544 1876 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe PID 1876 wrote to memory of 3544 1876 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe PID 1876 wrote to memory of 3544 1876 6adcad993626f90d1efcbb797c6fc63f.exe 6adcad993626f90d1efcbb797c6fc63f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6adcad993626f90d1efcbb797c6fc63f.exe"C:\Users\Admin\AppData\Local\Temp\6adcad993626f90d1efcbb797c6fc63f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6adcad993626f90d1efcbb797c6fc63f.exe"C:\Users\Admin\AppData\Local\Temp\6adcad993626f90d1efcbb797c6fc63f.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\6adcad993626f90d1efcbb797c6fc63f.exe"C:\Users\Admin\AppData\Local\Temp\6adcad993626f90d1efcbb797c6fc63f.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\6adcad993626f90d1efcbb797c6fc63f.exe"C:\Users\Admin\AppData\Local\Temp\6adcad993626f90d1efcbb797c6fc63f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1876-130-0x0000000000410000-0x00000000004B2000-memory.dmpFilesize
648KB
-
memory/1876-131-0x0000000005360000-0x0000000005904000-memory.dmpFilesize
5.6MB
-
memory/1876-132-0x0000000004DB0000-0x0000000004E42000-memory.dmpFilesize
584KB
-
memory/1876-133-0x0000000004D20000-0x0000000004D2A000-memory.dmpFilesize
40KB
-
memory/1876-134-0x0000000008DE0000-0x0000000008E7C000-memory.dmpFilesize
624KB
-
memory/1876-135-0x0000000008EF0000-0x0000000008F56000-memory.dmpFilesize
408KB
-
memory/3544-138-0x0000000000000000-mapping.dmp
-
memory/3544-139-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3544-140-0x0000000001050000-0x000000000139A000-memory.dmpFilesize
3.3MB
-
memory/4188-137-0x0000000000000000-mapping.dmp
-
memory/4856-136-0x0000000000000000-mapping.dmp