Analysis
-
max time kernel
108s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01-02-2023 05:13
Static task
static1
Behavioral task
behavioral1
Sample
75d999d431819311abf8bd048cd084acdcd5f4e1.exe
Resource
win7-20221111-en
General
-
Target
75d999d431819311abf8bd048cd084acdcd5f4e1.exe
-
Size
376KB
-
MD5
f3b6c4f3ff269bdcc55ad18ec7690497
-
SHA1
75d999d431819311abf8bd048cd084acdcd5f4e1
-
SHA256
854ed63f694e4f9526e3a1325691c934a328a82f5a73c5301b8e261c99b11b39
-
SHA512
30ded7705ce97f774ef98ba4b1888f9720185d430f161583fde1f926439fe91c348d3c7693ce1b34d3ccbd1dc907cb763faa86fb9249be864f6ab66807ad9de1
-
SSDEEP
6144:95iXLVYmUquirE7u/5F7LTVHqpX7zLh4JE5QI/6N6NMBwz+3meeKNf:95ib+mUquib/5FXhKp6Jari8GBNmeeK
Malware Config
Extracted
xloader
2.3
pzb5
laceez-store.com
fastcobra.icu
adust.site
parcelpunk.com
dabanse.info
themacshisha.com
ketogenic-success.com
simplyrip.com
antoniolima.icu
ruyakeji.net
sysintegrados2.com
triangle-resolute.com
muratkivrak.com
ntwrkrecs.com
gtxhcntq.icu
charlottepromo.com
trygreenbar.com
abbathandhottub.com
sliim-up.com
hoteldeleauvive.com
itsunnyinflorida.com
stukeyenterprise.com
texasmarijuanadispensary.com
makemestupid.com
wrapcare.info
elevencasual.com
berrymaps.com
eufootball.xyz
guiatrompeta.com
dlinteriordesigns.com
vseboliit.life
akoocg.com
liselibrary.com
strikeoutchallenge.com
blenheimdesigns.com
largeprintonline.com
nevillwearsprada.com
elyonbosstimer.com
bfjgktv.com
cybermovistar.com
morenosappliancerepair.com
sqxiandai.com
haneen-ts.com
askjiaju.net
soyalbalucia.com
mycounsellinghk.com
influentexports.com
disarmsales.com
sproutone.com
clasifood.com
gigafoon.com
donorsflames.store
clinique-alhanane.com
interdomiciliocanarias.com
modestin.online
magicisntreal.com
desibeast.com
thefreelanceteam.net
trendingproductus.com
bramwalda.com
fabriq-s.com
chaoticscave.net
7thenglish.com
howtogetmyboyfriendback.net
keprom.works
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2464-133-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
75d999d431819311abf8bd048cd084acdcd5f4e1.exedescription pid process target process PID 1972 set thread context of 2464 1972 75d999d431819311abf8bd048cd084acdcd5f4e1.exe 75d999d431819311abf8bd048cd084acdcd5f4e1.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
75d999d431819311abf8bd048cd084acdcd5f4e1.exepid process 2464 75d999d431819311abf8bd048cd084acdcd5f4e1.exe 2464 75d999d431819311abf8bd048cd084acdcd5f4e1.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
75d999d431819311abf8bd048cd084acdcd5f4e1.exepid process 1972 75d999d431819311abf8bd048cd084acdcd5f4e1.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
75d999d431819311abf8bd048cd084acdcd5f4e1.exedescription pid process target process PID 1972 wrote to memory of 2464 1972 75d999d431819311abf8bd048cd084acdcd5f4e1.exe 75d999d431819311abf8bd048cd084acdcd5f4e1.exe PID 1972 wrote to memory of 2464 1972 75d999d431819311abf8bd048cd084acdcd5f4e1.exe 75d999d431819311abf8bd048cd084acdcd5f4e1.exe PID 1972 wrote to memory of 2464 1972 75d999d431819311abf8bd048cd084acdcd5f4e1.exe 75d999d431819311abf8bd048cd084acdcd5f4e1.exe PID 1972 wrote to memory of 2464 1972 75d999d431819311abf8bd048cd084acdcd5f4e1.exe 75d999d431819311abf8bd048cd084acdcd5f4e1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75d999d431819311abf8bd048cd084acdcd5f4e1.exe"C:\Users\Admin\AppData\Local\Temp\75d999d431819311abf8bd048cd084acdcd5f4e1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\75d999d431819311abf8bd048cd084acdcd5f4e1.exe"C:\Users\Admin\AppData\Local\Temp\75d999d431819311abf8bd048cd084acdcd5f4e1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses