Analysis
-
max time kernel
150s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 11:01
Behavioral task
behavioral1
Sample
xDedicLogCleaner.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
xDedicLogCleaner.exe
Resource
win10v2004-20220901-en
General
-
Target
xDedicLogCleaner.exe
-
Size
1.6MB
-
MD5
0f34ab1e2166cada2be7c551e026507c
-
SHA1
550b803f22078ad75240011d7b766bd79871b932
-
SHA256
878706cd11b5223c89aaef08887b92a655a25b7c630950affa553574a60b922e
-
SHA512
0f7acef402f4ac2b9ebcccc9faa8debdb6ff0a99bf5c36c04b63da39184b4e2732dca6e40844cd7df560cf7b0ce0ec73d046f6667d6a48afba8c553795f1bcbd
-
SSDEEP
49152:xtuNXEZiAjGftDoCRt8aGQRRIpw/JpfFNeBz66Bc:n+XNATCRt8aGiX/j56
Malware Config
Signatures
-
Processes:
resource yara_rule C:\Windows\xDLS.exe aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
xDLS.exepid process 2016 xDLS.exe -
Drops file in Windows directory 1 IoCs
Processes:
xDedicLogCleaner.exedescription ioc process File created C:\Windows\xDLS.exe xDedicLogCleaner.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
xDedicLogCleaner.exexDLS.exepid process 1372 xDedicLogCleaner.exe 2016 xDLS.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
xDedicLogCleaner.exepid process 1372 xDedicLogCleaner.exe 1372 xDedicLogCleaner.exe 1372 xDedicLogCleaner.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
xDedicLogCleaner.exepid process 1372 xDedicLogCleaner.exe 1372 xDedicLogCleaner.exe 1372 xDedicLogCleaner.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
xDedicLogCleaner.exepid process 1372 xDedicLogCleaner.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
xDedicLogCleaner.exedescription pid process target process PID 1372 wrote to memory of 2016 1372 xDedicLogCleaner.exe xDLS.exe PID 1372 wrote to memory of 2016 1372 xDedicLogCleaner.exe xDLS.exe PID 1372 wrote to memory of 2016 1372 xDedicLogCleaner.exe xDLS.exe PID 1372 wrote to memory of 2016 1372 xDedicLogCleaner.exe xDLS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\xDedicLogCleaner.exe"C:\Users\Admin\AppData\Local\Temp\xDedicLogCleaner.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\xDLS.exeC:\Windows\xDLS.exe /install /silent2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\xDLS.exeFilesize
1.1MB
MD52f9ac709c1419b96771d81e1edd79e8a
SHA109f8cbc334f8c4ece1f27136842300b29c04ec46
SHA256d00cfb07692ea3d0533f082a14295f7e18383420c2a940a024030c8bad67fb3a
SHA51265095bb0a13403f99de88e49ceb8e26898802487860af898496deef2ac66f2740fc4e03c1146713f9b909257820e6be88800dc85f13274b40dc4759d47eecaa0
-
memory/1372-69-0x0000000000400000-0x000000000089F000-memory.dmpFilesize
4.6MB
-
memory/1372-55-0x0000000000400000-0x000000000089F000-memory.dmpFilesize
4.6MB
-
memory/1372-56-0x0000000000400000-0x000000000089F000-memory.dmpFilesize
4.6MB
-
memory/1372-57-0x0000000000400000-0x000000000089F000-memory.dmpFilesize
4.6MB
-
memory/1372-58-0x0000000000400000-0x000000000089F000-memory.dmpFilesize
4.6MB
-
memory/1372-70-0x0000000003660000-0x0000000003A97000-memory.dmpFilesize
4.2MB
-
memory/1372-62-0x0000000003660000-0x0000000003A97000-memory.dmpFilesize
4.2MB
-
memory/1372-54-0x0000000076041000-0x0000000076043000-memory.dmpFilesize
8KB
-
memory/2016-64-0x0000000000400000-0x0000000000837000-memory.dmpFilesize
4.2MB
-
memory/2016-65-0x0000000000400000-0x0000000000837000-memory.dmpFilesize
4.2MB
-
memory/2016-66-0x0000000000400000-0x0000000000837000-memory.dmpFilesize
4.2MB
-
memory/2016-67-0x0000000000400000-0x0000000000837000-memory.dmpFilesize
4.2MB
-
memory/2016-68-0x0000000000400000-0x0000000000837000-memory.dmpFilesize
4.2MB
-
memory/2016-63-0x0000000000400000-0x0000000000837000-memory.dmpFilesize
4.2MB
-
memory/2016-59-0x0000000000000000-mapping.dmp