Analysis
-
max time kernel
53s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 12:48
Static task
static1
Behavioral task
behavioral1
Sample
5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe
Resource
win10v2004-20221111-en
General
-
Target
5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe
-
Size
556KB
-
MD5
e866034515b719467290d53f5919d599
-
SHA1
8cab0abfaaa087630930df86c8e25d5c9123dc75
-
SHA256
5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097
-
SHA512
a2601cfe472869b73fcec91aa03263ad74e49f2862d5dd22256376acf5002102c4f197a74116ebdafdd95744bf3c57a436c6a2e1850cf85351c3a9aafa48319d
-
SSDEEP
6144:Kd5DMAYloj1/L8YEAQwgG5hUQf+a/07WbvW17ZdhG3uK1gSySxfcph:Kd5DMAzjN4YEAFdmaM6UjhCu+gSeph
Malware Config
Extracted
xloader
2.3
h3qo
dhflow.com
jyindex.com
ezcleanhandle.com
trungtamcongdong.online
simsprotectionagency.com
easylivemeet.com
blackvikingfashionhouse.com
52banxue.com
girlsinit.com
drhemo.com
freethefarmers.com
velvetrosephotography.com
geometricbotaniclas.com
skyandspirit.com
deltacomunicacao.com
mucademy.com
jaboilfieldsolutions.net
howtowinatblackjacknow.com
anytimegrowth.com
simranluthra.com
thefinleyshow.com
basalmeals.com
esurpluss.com
hrbjczsfs.com
tourphuquocnguyenhien.com
mxprographics.com
themetaphysicalmaster.net
directorystar.asia
thehomeofdiamonds.com
riqinxin.com
covicio.com
sciineurope.com
womensportclothes.com
celestialchimes.net
lotsmen.com
hi-rescloud.net
lewisnathaniel.com
ageonward.com
eyetownglasses.com
bingent.info
matildealvaradovera.com
otorrinonews.com
cdeg898.com
lexingtoncoorgresort.com
minidachshundpups.com
tools365-shop.com
romancingtheeras.com
residentmining.com
aquaflowsprinklers.com
crackapks.com
caffeinatedeverafter.com
sureyyapasa.net
strawberryhearts.com
ptgo.net
devyshkam.com
thethrottletherapy.com
givelyrics.com
signaturepsinc.com
mersinsudunyasi.com
fivedayskitchen.com
fefebeauty.com
long0001.com
hmm40.com
claracarbon.com
elevatedenterprizes.com
Signatures
-
Xloader payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/768-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/768-63-0x000000000041D0E0-mapping.dmp xloader -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/1908-56-0x0000000005240000-0x0000000005268000-memory.dmp agile_net -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exedescription pid process target process PID 1908 set thread context of 768 1908 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exepid process 1908 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe 1908 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe 768 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exedescription pid process Token: SeDebugPrivilege 1908 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exedescription pid process target process PID 1908 wrote to memory of 768 1908 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe PID 1908 wrote to memory of 768 1908 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe PID 1908 wrote to memory of 768 1908 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe PID 1908 wrote to memory of 768 1908 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe PID 1908 wrote to memory of 768 1908 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe PID 1908 wrote to memory of 768 1908 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe PID 1908 wrote to memory of 768 1908 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe 5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe"C:\Users\Admin\AppData\Local\Temp\5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe"C:\Users\Admin\AppData\Local\Temp\5ed6b87afc6eddea0e7275496364bb9cc2b0246f7fe36069a69cdf50b6823097.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/768-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/768-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/768-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/768-63-0x000000000041D0E0-mapping.dmp
-
memory/768-64-0x0000000000B70000-0x0000000000E73000-memory.dmpFilesize
3.0MB
-
memory/1908-54-0x0000000000AE0000-0x0000000000B70000-memory.dmpFilesize
576KB
-
memory/1908-55-0x00000000753C1000-0x00000000753C3000-memory.dmpFilesize
8KB
-
memory/1908-56-0x0000000005240000-0x0000000005268000-memory.dmpFilesize
160KB
-
memory/1908-57-0x0000000000AD0000-0x0000000000AE4000-memory.dmpFilesize
80KB
-
memory/1908-58-0x0000000000A30000-0x0000000000A36000-memory.dmpFilesize
24KB