Analysis
-
max time kernel
41s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
25-05-2023 01:06
Static task
static1
Behavioral task
behavioral1
Sample
50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe
Resource
win7-20230220-en
General
-
Target
50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe
-
Size
341KB
-
MD5
2a11ef715093c4429cd05dc3950c7f89
-
SHA1
3199e3c72fc349d9cce951c2c8830d88a8da4454
-
SHA256
50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158
-
SHA512
24f2d7a608d421258334144217e97dccdeb023d5e621774f213eda210a8937df0c7d12cfd02e8c96d5951011d6142a320ca3b40bedb8ac6ad5f95ccc6d3d2d0a
-
SSDEEP
6144:HqPwmYdAbc0C3LFDDOQmjUi0GL9jDAlPMKpPbd6j62AeI4KR0VoFtDFF7g:HqPwmYdAbc0CboQmjIGN6Pzd6j6/eWtU
Malware Config
Extracted
xloader
2.5
c6si
tristateinc.construction
americanscaregroundstexas.com
kanimisoshiru.com
wihling.com
fishcheekstosa.com
parentsfuid.com
greenstandmarket.com
fc8fla8kzq.com
gametwist-83.club
jobsncvs.com
directrealtysells.com
avida2015.com
conceptasite.net
arkaneattire.com
indev-mobility.info
2160centurypark412.com
valefloor.com
septembership.com
stackflix.com
jimc0sales.net
socialviralup.com
lastra41.com
juliaepaulovaocasar.com
jurisagora.com
drawandgrow.online
rebekahlouise.com
herport-fr.com
iphone13.webcam
appz-one.net
inpost-pl.net
promocion360fitness.com
global-forbes.biz
diamondtrade.net
albertcantos.com
gtgits.com
travel-ai.online
busipe6.com
mualikesubvn.com
niftyhandy.com
docprops.com
lido88.bet
baywoodphotography.com
cargosouq.info
newsnowlive.online
floridafishingoverboard.com
missnikissalsa.net
walletvalidate.space
kissimmeeinternationalcup.com
charterhome.school
gurujupiter.com
entertainmentwitchy.com
jokeaou.com
sugarmountainfirearms.com
iss-sa.com
smittyssierra.com
freedomoff.com
giftoin.com
realitystararmwrestling.com
salsalunch-equallyage.com
ladouba.com
thepropertygoat.com
bestofmerrick.guide
4the.top
regioinversiones.com
129qihu.com
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/704-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exedescription pid process target process PID 920 set thread context of 704 920 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exepid process 704 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exedescription pid process target process PID 920 wrote to memory of 704 920 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe PID 920 wrote to memory of 704 920 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe PID 920 wrote to memory of 704 920 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe PID 920 wrote to memory of 704 920 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe PID 920 wrote to memory of 704 920 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe PID 920 wrote to memory of 704 920 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe PID 920 wrote to memory of 704 920 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe"C:\Users\Admin\AppData\Local\Temp\50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe"C:\Users\Admin\AppData\Local\Temp\50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/704-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/704-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/704-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/704-61-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/704-63-0x00000000009F0000-0x0000000000CF3000-memory.dmpFilesize
3.0MB
-
memory/920-54-0x0000000000800000-0x000000000085C000-memory.dmpFilesize
368KB
-
memory/920-55-0x0000000004D20000-0x0000000004D60000-memory.dmpFilesize
256KB
-
memory/920-56-0x0000000000450000-0x000000000045C000-memory.dmpFilesize
48KB
-
memory/920-57-0x0000000004D20000-0x0000000004D60000-memory.dmpFilesize
256KB
-
memory/920-58-0x0000000004E90000-0x0000000004EEE000-memory.dmpFilesize
376KB