Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2023 23:32
Static task
static1
Behavioral task
behavioral1
Sample
436e92098a95e694d9c7d6d63e522e3a.exe
Resource
win7-20231129-en
General
-
Target
436e92098a95e694d9c7d6d63e522e3a.exe
-
Size
255KB
-
MD5
436e92098a95e694d9c7d6d63e522e3a
-
SHA1
8811636dd2e2b6b5fd32cd2bf0ad3c277718db4b
-
SHA256
abb184e2afdbbc65327aa2ce9eb3075cade745126b8da118abbebc0c5ad8b7e5
-
SHA512
47a12ec4b32b9687d7da340d7adeabe1f240a175c3c00f646860efa2126ad324fc40cd3428d54e15ef4c14ed2d380b10162e2f60f895ca5f4678d2da18422032
-
SSDEEP
6144:WLWfVPtZVWre+os+zrWRqXbh2FKhpo2ax3eOUEJUBJND:bfVVWrzR+uR4bhm0pofNUEJUBD
Malware Config
Extracted
xloader
2.3
b6a4
reviewsresolutions.com
binhminhgardenshophouse.com
nebulacom.com
kadhambaristudio.com
viltoom.club
supmomma.com
tjszxddc.com
darlingmemories.com
hyperultrapure.com
vibembrio.com
reallycoolmask.com
cumbukita.com
brian-newby.com
abstractaccessories.com
marykinky.com
minnesotareversemtgloans.com
prasetlement.com
xplpgi.com
xn--gdask-y7a.com
uababaseball.com
intesmartscale.com
hmwcin.com
pavel-levakov.com
esmebonnell.com
hdyfworldwide.com
shanghaino1milpitas.com
abrosnm3.com
millenialife.info
cgfia.com
sk275.com
anwaltmaier.wien
adminlagu.com
halaltory.com
ketofoodfight.club
mossymilecouture.com
toinfinityandabroad.com
goldstreamradio.com
hs-ciq.net
shedajackson.com
kussharoko.net
superpackersmovers.com
thecarbonbox.store
kayfkitchen.com
remedicore.com
zfozxr.icu
bloodbluemoons.com
vistaonlinedemo.com
tucirculodeideas.com
saanythinghealth.com
codenevisi.com
pickyclick.com
streammsex.com
ledtorchtr.com
louisgrech.com
realdocumentsforsale.com
compragospel.com
starlet5.xyz
phasmaelectro.com
kos-living.com
casamattapm.com
ievapavulane.com
wakeupwithfreedom.com
matkomiljevic.com
leonaprojects.com
miraculousventures.com
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2312-3-0x0000000000400000-0x0000000000428000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
436e92098a95e694d9c7d6d63e522e3a.exedescription pid process target process PID 2952 set thread context of 2312 2952 436e92098a95e694d9c7d6d63e522e3a.exe 436e92098a95e694d9c7d6d63e522e3a.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
436e92098a95e694d9c7d6d63e522e3a.exepid process 2312 436e92098a95e694d9c7d6d63e522e3a.exe 2312 436e92098a95e694d9c7d6d63e522e3a.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
436e92098a95e694d9c7d6d63e522e3a.exepid process 2952 436e92098a95e694d9c7d6d63e522e3a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
436e92098a95e694d9c7d6d63e522e3a.exedescription pid process target process PID 2952 wrote to memory of 2312 2952 436e92098a95e694d9c7d6d63e522e3a.exe 436e92098a95e694d9c7d6d63e522e3a.exe PID 2952 wrote to memory of 2312 2952 436e92098a95e694d9c7d6d63e522e3a.exe 436e92098a95e694d9c7d6d63e522e3a.exe PID 2952 wrote to memory of 2312 2952 436e92098a95e694d9c7d6d63e522e3a.exe 436e92098a95e694d9c7d6d63e522e3a.exe PID 2952 wrote to memory of 2312 2952 436e92098a95e694d9c7d6d63e522e3a.exe 436e92098a95e694d9c7d6d63e522e3a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\436e92098a95e694d9c7d6d63e522e3a.exe"C:\Users\Admin\AppData\Local\Temp\436e92098a95e694d9c7d6d63e522e3a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\436e92098a95e694d9c7d6d63e522e3a.exe"C:\Users\Admin\AppData\Local\Temp\436e92098a95e694d9c7d6d63e522e3a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2312
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2312-3-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2312-4-0x00000000012F0000-0x000000000163A000-memory.dmpFilesize
3.3MB
-
memory/2952-1-0x0000000000E00000-0x0000000000F00000-memory.dmpFilesize
1024KB
-
memory/2952-2-0x0000000001500000-0x0000000001502000-memory.dmpFilesize
8KB