Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 20:04
Static task
static1
Behavioral task
behavioral1
Sample
3a0f86482d12e9d3a275763997708d9b.exe
Resource
win7-20231215-en
General
-
Target
3a0f86482d12e9d3a275763997708d9b.exe
-
Size
1.2MB
-
MD5
3a0f86482d12e9d3a275763997708d9b
-
SHA1
3f0c0e46ccc58b066331946101c9c8004fa8c9b2
-
SHA256
b5918ac7fd3c3323260a3158fe0230b58cdb7098bb659285374e5e2dc1c75f7d
-
SHA512
a2cad015fcb45163fdff6d99b5518d952635c7b0e19a47b31f8736f8a12ba21df1f13f0fa79e6e749dce826aeda0aa7e1ab42fd6138e96992fce59368bf52b5a
-
SSDEEP
12288:NYokHiZLn+XEPxm8lh0CmGIwV3r5lUtWeiQR2q0+aeSj1fZ0SW64+mRyK033kwsG:NYccCmDGOsBgo0q4wM3L2q/rKLh3HzM
Malware Config
Extracted
xloader
2.3
u3r5
alashan.ltd
demopagephequan.online
garxznql.icu
unetart.com
dajiangzhibo15.com
influencer.fund
beverlyhills.city
strefafryzur.net
giftboxhawaii.com
ecotiare.com
homeandgardenradioshow.com
sageandsandco.com
laflesoley.com
icipatanegra.online
autovistoriapredial.net
xn--polenezkypark-pmb.com
cbdamic.com
aaronandmarissa.com
datasoma.digital
theclosetology.com
seemajindal.com
smartphone-digital.com
mldarby.com
ljhlwyy.com
racevc.com
aritailor.com
neuromemebook.com
zpnfoslqyshplulrkycalmor.com
123movie.review
enisis.info
thecalligraphyguide.com
confirmcarousel.life
djaystransport.com
joyful888.com
realmarketingtools.com
greensstrings.com
rhinohealthnews.club
daonedu.net
everythingfinesse.com
vitalgiant.com
youhodlwr.com
originalownersonline.com
testci20200827122104.com
japanmatrix.xyz
bodybrush-shower.com
careinnovationsummit.com
thefreakypeach.com
houstoncupcakes.com
medisola.xyz
taconicsearchmarketing.com
parcclematis-newlaunch.com
zhongshengzhenzhi.com
txdv-scmcz.xyz
buy-colorado.com
membership.site
amirbakhtiar.com
healthonours.com
tanja-wittk1975.com
gemaylola.com
inpursuitofmyfirstlove.com
advantagebusiness-solutions.com
modernlegacyacademy.com
psuscience.com
wakumo.store
cumhuriyetcidemokratpartisi.kim
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
resource yara_rule behavioral2/memory/4876-8-0x0000000004900000-0x0000000004912000-memory.dmp CustAttr -
Xloader payload 1 IoCs
resource yara_rule behavioral2/memory/4888-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4876 set thread context of 4888 4876 3a0f86482d12e9d3a275763997708d9b.exe 101 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4888 3a0f86482d12e9d3a275763997708d9b.exe 4888 3a0f86482d12e9d3a275763997708d9b.exe 4888 3a0f86482d12e9d3a275763997708d9b.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4876 wrote to memory of 4888 4876 3a0f86482d12e9d3a275763997708d9b.exe 101 PID 4876 wrote to memory of 4888 4876 3a0f86482d12e9d3a275763997708d9b.exe 101 PID 4876 wrote to memory of 4888 4876 3a0f86482d12e9d3a275763997708d9b.exe 101 PID 4876 wrote to memory of 4888 4876 3a0f86482d12e9d3a275763997708d9b.exe 101 PID 4876 wrote to memory of 4888 4876 3a0f86482d12e9d3a275763997708d9b.exe 101 PID 4876 wrote to memory of 4888 4876 3a0f86482d12e9d3a275763997708d9b.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a0f86482d12e9d3a275763997708d9b.exe"C:\Users\Admin\AppData\Local\Temp\3a0f86482d12e9d3a275763997708d9b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\3a0f86482d12e9d3a275763997708d9b.exe"C:\Users\Admin\AppData\Local\Temp\3a0f86482d12e9d3a275763997708d9b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4888
-