Analysis
-
max time kernel
37s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 19:38
Static task
static1
Behavioral task
behavioral1
Sample
ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe
Resource
win7-20220812-en
General
-
Target
ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe
-
Size
2.4MB
-
MD5
402094b5077f7c94530f78882e1a9def
-
SHA1
d0d7ac67bba3022b3649d8766402a3f67d84e688
-
SHA256
ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb
-
SHA512
7a0204b584706c44edfb031f7713b5589ffa0d4c681355a287920e7758c0b1cfdad2ba7abfaa6f7b928aa7193f04564a6818b9052535ba53ee25076f42ca3075
-
SSDEEP
49152:RqoZ0ajbQzlK5O+l4QOnn8jeX+l8uvlhfNf5lWLPNyeL9+hw/USGy7Xk/51HwgGF:5X0zli6u4985m0sQ1a7
Malware Config
Extracted
xloader
2.3
ivay
b4ukid.com
missioncontrol2030.com
chriswhitefoto.com
guepard-marine.com
getlauded.com
jingdonglm.com
clintlove.com
boldstrategicmedia.com
bluebay3dwdmall.com
aishag.com
forexexpoaward.com
basslakedisposal.com
bukannyaterbuai36.com
learntrhc.com
cancunpolo.com
case-cornershop.com
tahiticomplementos.com
dashanzhf.com
wholeholistichealth.com
inass-yassin.com
citestiprb151at29.com
kazancsere.net
ittakesavillagekitchen.info
jkmibszou.icu
lindamaearmstrong.com
chaithanyaonline.com
blowdryingcontest.com
nail-junkie.com
wokinbarbecue.com
thefreemusic.net
digitaldynasti.com
unclonedstream.com
utensilgranchi.com
meszur.com
stevebucci.com
acresvisionent.com
knit1eat1.com
highendsmokeshop.com
pearyazilim.com
andcarryon.com
nailzcrafted.com
homekitchenid.com
pingds.info
connectionsitsolutions.com
tradesfortomorrow.com
roadofcherrytrees.com
roeromeccanica.com
rzpte.com
royaibanks.com
freshwaterflower.com
livr.chat
findandnews.com
cpnpproductions.com
jacknow123.com
kaywoodward.com
houseofvortex.com
goodfood.directory
bosolia.com
caragross.com
racevx.xyz
americanshieldhome.com
drexelflux.com
gxwl1688.com
hurrytrip.com
digitalneeds.tech
Signatures
-
Beds Protector Packer 1 IoCs
Detects Beds Protector packer used to load .NET malware.
Processes:
resource yara_rule behavioral1/memory/1720-56-0x0000000005070000-0x00000000052D8000-memory.dmp beds_protector -
Xloader payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1856-61-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1856-62-0x000000000041D080-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exedescription pid process target process PID 1720 set thread context of 1856 1720 ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1052 1720 WerFault.exe ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exepid process 1856 ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exedescription pid process target process PID 1720 wrote to memory of 1856 1720 ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe PID 1720 wrote to memory of 1856 1720 ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe PID 1720 wrote to memory of 1856 1720 ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe PID 1720 wrote to memory of 1856 1720 ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe PID 1720 wrote to memory of 1856 1720 ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe PID 1720 wrote to memory of 1856 1720 ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe PID 1720 wrote to memory of 1856 1720 ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe PID 1720 wrote to memory of 1052 1720 ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe WerFault.exe PID 1720 wrote to memory of 1052 1720 ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe WerFault.exe PID 1720 wrote to memory of 1052 1720 ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe WerFault.exe PID 1720 wrote to memory of 1052 1720 ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe"C:\Users\Admin\AppData\Local\Temp\ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe"C:\Users\Admin\AppData\Local\Temp\ba80a5efff5dcb59efb1cd4fd12ac508b6e1fb9774d119893fb721b2d1d8f8cb.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 6842⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1052-64-0x0000000000000000-mapping.dmp
-
memory/1720-54-0x0000000000B60000-0x0000000000DD8000-memory.dmpFilesize
2.5MB
-
memory/1720-55-0x00000000762B1000-0x00000000762B3000-memory.dmpFilesize
8KB
-
memory/1720-56-0x0000000005070000-0x00000000052D8000-memory.dmpFilesize
2.4MB
-
memory/1720-57-0x0000000000210000-0x0000000000226000-memory.dmpFilesize
88KB
-
memory/1856-58-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1856-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1856-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1856-62-0x000000000041D080-mapping.dmp
-
memory/1856-63-0x0000000000850000-0x0000000000B53000-memory.dmpFilesize
3.0MB