Analysis
-
max time kernel
54s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 07:14
Static task
static1
Behavioral task
behavioral1
Sample
214410acd621e551b295b93f5e5f61c1.exe
Resource
win7-20220414-en
General
-
Target
214410acd621e551b295b93f5e5f61c1.exe
-
Size
660KB
-
MD5
214410acd621e551b295b93f5e5f61c1
-
SHA1
5f6ecc217d61fe0675815eccb242663223c0f947
-
SHA256
f6b709d4d41b801c2f5df85f05f3396ab9a2d0b1851ebdc5e434b03c184dacd6
-
SHA512
7788d66004ef9d91faed6aa66c7e6f7bcd3a8d8d27dc6af5c31907165838921f46cdd76eea96b51da5c7b0a6af56a0f1abf3ab419a0844b500214140b19b2485
Malware Config
Extracted
xloader
2.6
a2es
glutenfreebahrain.com
sportrid.com
js-films.com
cie-revolver.com
outsourcinginstitutebd.com
roboticsdatascience.com
tebrunk.com
needgreatwork.com
df1b8j2iwbl33n.life
voluum-training.com
cherna-roza.com
xiyouap.com
bluefiftyfoundation.com
angolettomc.com
yhcp225.com
keondredejawn.com
ifeelsilky.com
coraorganizing.com
smartmindstutorials.com
tanphucuong.info
cxy.cool
criatorioimperial.online
timelyzer.com
chounvwd.com
taxidrivertrading.com
vooyage.xyz
mbtq.financial
tmshop.ma
newexmag.com
wildblumebmd.com
faucetvddw.club
sexism.info
precisionspinecolorado.com
jmigy.com
theplayhouse88.com
theskinrevive.com
envisionexpereience.com
matuschekandcompany.com
zouyuting.com
loansbill-pay.website
albertoalaniz.space
elfstore.net
klapia.online
panxiaozhi.net
soprodutosgeniais.com
amstorex.com
tiktokrycy41.xyz
datisbrick.com
hotelnoucanguillem.com
prekkr.com
jensenko.com
spiritualteashop.com
cyberdyne.world
0xauetw0ye50f.xyz
berendsit.com
kalycollcwn.info
tonenusdt.xyz
ckhla.com
igralki.com
princesskinnymixers.com
tvmountinstallguy.com
choicegoodsshop.com
diamont-services.com
mideazhiyou.com
katescakesandcreations.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2016-63-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/2016-64-0x000000000041F2B0-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
214410acd621e551b295b93f5e5f61c1.exedescription pid process target process PID 1520 set thread context of 2016 1520 214410acd621e551b295b93f5e5f61c1.exe 214410acd621e551b295b93f5e5f61c1.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
214410acd621e551b295b93f5e5f61c1.exepid process 2016 214410acd621e551b295b93f5e5f61c1.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
214410acd621e551b295b93f5e5f61c1.exedescription pid process target process PID 1520 wrote to memory of 2016 1520 214410acd621e551b295b93f5e5f61c1.exe 214410acd621e551b295b93f5e5f61c1.exe PID 1520 wrote to memory of 2016 1520 214410acd621e551b295b93f5e5f61c1.exe 214410acd621e551b295b93f5e5f61c1.exe PID 1520 wrote to memory of 2016 1520 214410acd621e551b295b93f5e5f61c1.exe 214410acd621e551b295b93f5e5f61c1.exe PID 1520 wrote to memory of 2016 1520 214410acd621e551b295b93f5e5f61c1.exe 214410acd621e551b295b93f5e5f61c1.exe PID 1520 wrote to memory of 2016 1520 214410acd621e551b295b93f5e5f61c1.exe 214410acd621e551b295b93f5e5f61c1.exe PID 1520 wrote to memory of 2016 1520 214410acd621e551b295b93f5e5f61c1.exe 214410acd621e551b295b93f5e5f61c1.exe PID 1520 wrote to memory of 2016 1520 214410acd621e551b295b93f5e5f61c1.exe 214410acd621e551b295b93f5e5f61c1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\214410acd621e551b295b93f5e5f61c1.exe"C:\Users\Admin\AppData\Local\Temp\214410acd621e551b295b93f5e5f61c1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\214410acd621e551b295b93f5e5f61c1.exe"C:\Users\Admin\AppData\Local\Temp\214410acd621e551b295b93f5e5f61c1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1520-54-0x0000000000A70000-0x0000000000B1C000-memory.dmpFilesize
688KB
-
memory/1520-55-0x0000000076451000-0x0000000076453000-memory.dmpFilesize
8KB
-
memory/1520-56-0x00000000004E0000-0x0000000000500000-memory.dmpFilesize
128KB
-
memory/1520-57-0x0000000002220000-0x000000000222E000-memory.dmpFilesize
56KB
-
memory/1520-58-0x0000000005840000-0x00000000058BA000-memory.dmpFilesize
488KB
-
memory/1520-59-0x0000000004D70000-0x0000000004DA2000-memory.dmpFilesize
200KB
-
memory/2016-60-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2016-61-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2016-63-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2016-64-0x000000000041F2B0-mapping.dmp
-
memory/2016-65-0x0000000000B20000-0x0000000000E23000-memory.dmpFilesize
3.0MB