Analysis
-
max time kernel
138s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2023 18:11
Static task
static1
Behavioral task
behavioral1
Sample
735f2dd2051269d409780124ab42684b.exe
Resource
win7-20231129-en
General
-
Target
735f2dd2051269d409780124ab42684b.exe
-
Size
787KB
-
MD5
735f2dd2051269d409780124ab42684b
-
SHA1
66443515bba44268a282314173f47d124715f806
-
SHA256
05c725f7ddf2734baa5fd91bf542ca03731d754d41283a2c0fd78bc9c369f28a
-
SHA512
f56f766f5030cad37de65d80e38eb26290f656152b81c97fe41470c8356f202e35199606d19858c1aeb09af014f1c29914e02f7f42a84e70f54d8911575fc725
-
SSDEEP
12288:p3YPk+SBNMCt8uKOtmpz46bkIrz4im9SGrGJuuchOMB+iBxt9VjW:1YPwBL6bprcWGqJuHFx3VjW
Malware Config
Extracted
xloader
2.5
cuig
sofiathinks-elderly.net
lahamicoast.info
2shengman.com
cbsautoplex.com
arcana-candles.com
genrage.com
kukumiou.xyz
thequizerking.com
sonataproductions.com
rebuildgomnmf.xyz
ubcoin.store
yiyouxue.net
firstlifehome.com
mdx-inc.net
gotbn-c01.com
dinobrindes.store
jcm-iso.com
cliente-mais.com
mloujewelry.com
correoversoi.quest
rc-rental-housing.com
swisstrustcitybank.com
traderjoes-corp.com
mandolinmeditations.com
kathcorp.com
mcdonaldsfastdel.xyz
nielsqanalytics.com
bansity.com
mimosymas.com
atp-cayenne.com
sinterekes.com
nnxsk.com
shushigallery.tech
thgn41.xyz
resporn.tech
growingki.com
themyopiatoolbox.com
angeleyesevents.com
reddishgomjtd.xyz
amazonretailbrickandmotar.net
jewelrybyjma.com
ctroutdoors.pro
357961.com
theakfam.business
skincarefamily.com
xptoempeendimentos.com
tapestrirewards.com
viridilodge.com
bostondowntownrealestate.com
disrepairclaimsuk.com
makaroff.net
thedoublezbar.com
barbicidemalaysia.com
sliv-a.online
showgeini.com
martialartsreigns.online
metamode.space
ch95516.ink
halvorson-pickup.com
mizuno-trouble.net
46dgj.xyz
esylf4vt.xyz
chopaap.com
igorleonardo.com
qtih.top
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4204-11-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
735f2dd2051269d409780124ab42684b.exedescription pid process target process PID 3572 set thread context of 4204 3572 735f2dd2051269d409780124ab42684b.exe 735f2dd2051269d409780124ab42684b.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
735f2dd2051269d409780124ab42684b.exe735f2dd2051269d409780124ab42684b.exepid process 3572 735f2dd2051269d409780124ab42684b.exe 3572 735f2dd2051269d409780124ab42684b.exe 3572 735f2dd2051269d409780124ab42684b.exe 3572 735f2dd2051269d409780124ab42684b.exe 3572 735f2dd2051269d409780124ab42684b.exe 3572 735f2dd2051269d409780124ab42684b.exe 3572 735f2dd2051269d409780124ab42684b.exe 3572 735f2dd2051269d409780124ab42684b.exe 3572 735f2dd2051269d409780124ab42684b.exe 3572 735f2dd2051269d409780124ab42684b.exe 4204 735f2dd2051269d409780124ab42684b.exe 4204 735f2dd2051269d409780124ab42684b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
735f2dd2051269d409780124ab42684b.exedescription pid process Token: SeDebugPrivilege 3572 735f2dd2051269d409780124ab42684b.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
735f2dd2051269d409780124ab42684b.exedescription pid process target process PID 3572 wrote to memory of 1876 3572 735f2dd2051269d409780124ab42684b.exe 735f2dd2051269d409780124ab42684b.exe PID 3572 wrote to memory of 1876 3572 735f2dd2051269d409780124ab42684b.exe 735f2dd2051269d409780124ab42684b.exe PID 3572 wrote to memory of 1876 3572 735f2dd2051269d409780124ab42684b.exe 735f2dd2051269d409780124ab42684b.exe PID 3572 wrote to memory of 3392 3572 735f2dd2051269d409780124ab42684b.exe 735f2dd2051269d409780124ab42684b.exe PID 3572 wrote to memory of 3392 3572 735f2dd2051269d409780124ab42684b.exe 735f2dd2051269d409780124ab42684b.exe PID 3572 wrote to memory of 3392 3572 735f2dd2051269d409780124ab42684b.exe 735f2dd2051269d409780124ab42684b.exe PID 3572 wrote to memory of 4204 3572 735f2dd2051269d409780124ab42684b.exe 735f2dd2051269d409780124ab42684b.exe PID 3572 wrote to memory of 4204 3572 735f2dd2051269d409780124ab42684b.exe 735f2dd2051269d409780124ab42684b.exe PID 3572 wrote to memory of 4204 3572 735f2dd2051269d409780124ab42684b.exe 735f2dd2051269d409780124ab42684b.exe PID 3572 wrote to memory of 4204 3572 735f2dd2051269d409780124ab42684b.exe 735f2dd2051269d409780124ab42684b.exe PID 3572 wrote to memory of 4204 3572 735f2dd2051269d409780124ab42684b.exe 735f2dd2051269d409780124ab42684b.exe PID 3572 wrote to memory of 4204 3572 735f2dd2051269d409780124ab42684b.exe 735f2dd2051269d409780124ab42684b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\735f2dd2051269d409780124ab42684b.exe"C:\Users\Admin\AppData\Local\Temp\735f2dd2051269d409780124ab42684b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\735f2dd2051269d409780124ab42684b.exe"C:\Users\Admin\AppData\Local\Temp\735f2dd2051269d409780124ab42684b.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\735f2dd2051269d409780124ab42684b.exe"C:\Users\Admin\AppData\Local\Temp\735f2dd2051269d409780124ab42684b.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\735f2dd2051269d409780124ab42684b.exe"C:\Users\Admin\AppData\Local\Temp\735f2dd2051269d409780124ab42684b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3572-6-0x0000000005880000-0x000000000588A000-memory.dmpFilesize
40KB
-
memory/3572-0-0x0000000074E20000-0x00000000755D0000-memory.dmpFilesize
7.7MB
-
memory/3572-2-0x0000000005BD0000-0x0000000006174000-memory.dmpFilesize
5.6MB
-
memory/3572-3-0x00000000056C0000-0x0000000005752000-memory.dmpFilesize
584KB
-
memory/3572-4-0x00000000057E0000-0x00000000057F0000-memory.dmpFilesize
64KB
-
memory/3572-5-0x0000000005780000-0x000000000578A000-memory.dmpFilesize
40KB
-
memory/3572-1-0x0000000000C10000-0x0000000000CDA000-memory.dmpFilesize
808KB
-
memory/3572-7-0x0000000074E20000-0x00000000755D0000-memory.dmpFilesize
7.7MB
-
memory/3572-10-0x0000000006B80000-0x0000000006BF8000-memory.dmpFilesize
480KB
-
memory/3572-9-0x0000000006A00000-0x0000000006A9C000-memory.dmpFilesize
624KB
-
memory/3572-8-0x00000000057E0000-0x00000000057F0000-memory.dmpFilesize
64KB
-
memory/3572-13-0x0000000074E20000-0x00000000755D0000-memory.dmpFilesize
7.7MB
-
memory/4204-11-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4204-14-0x00000000011B0000-0x00000000014FA000-memory.dmpFilesize
3.3MB