Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2023 21:30
Static task
static1
Behavioral task
behavioral1
Sample
f97387cf1ed097f9f1185ecb8d63d425.exe
Resource
win7-20231215-en
General
-
Target
f97387cf1ed097f9f1185ecb8d63d425.exe
-
Size
418KB
-
MD5
f97387cf1ed097f9f1185ecb8d63d425
-
SHA1
a737798f98adfedab12d1b8161ebfc0db31767da
-
SHA256
b4bb472d39c592fc4e99ecdd59cc1284255666c72ba5eccc7f5b39780e53141e
-
SHA512
b8aadb681f1e492bea50f722d34a431c5fb46c32fdb23ca54f5bc43474672dae49ef95d3e3188b739561b6f76c8d05b1ab07d34473da2c3a1dcfff18a866185d
-
SSDEEP
6144:3LTfaVy5OOu+n20JpbO8yfyV68lyixJQ0KDJNXiTF85rDcp0+DMC:vfalOu+n/U8c50WNCFy3x+QC
Malware Config
Extracted
xloader
2.3
b6a4
reviewsresolutions.com
binhminhgardenshophouse.com
nebulacom.com
kadhambaristudio.com
viltoom.club
supmomma.com
tjszxddc.com
darlingmemories.com
hyperultrapure.com
vibembrio.com
reallycoolmask.com
cumbukita.com
brian-newby.com
abstractaccessories.com
marykinky.com
minnesotareversemtgloans.com
prasetlement.com
xplpgi.com
xn--gdask-y7a.com
uababaseball.com
intesmartscale.com
hmwcin.com
pavel-levakov.com
esmebonnell.com
hdyfworldwide.com
shanghaino1milpitas.com
abrosnm3.com
millenialife.info
cgfia.com
sk275.com
anwaltmaier.wien
adminlagu.com
halaltory.com
ketofoodfight.club
mossymilecouture.com
toinfinityandabroad.com
goldstreamradio.com
hs-ciq.net
shedajackson.com
kussharoko.net
superpackersmovers.com
thecarbonbox.store
kayfkitchen.com
remedicore.com
zfozxr.icu
bloodbluemoons.com
vistaonlinedemo.com
tucirculodeideas.com
saanythinghealth.com
codenevisi.com
pickyclick.com
streammsex.com
ledtorchtr.com
louisgrech.com
realdocumentsforsale.com
compragospel.com
starlet5.xyz
phasmaelectro.com
kos-living.com
casamattapm.com
ievapavulane.com
wakeupwithfreedom.com
matkomiljevic.com
leonaprojects.com
miraculousventures.com
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2136-3-0x0000000000400000-0x0000000000428000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f97387cf1ed097f9f1185ecb8d63d425.exedescription pid process target process PID 228 set thread context of 2136 228 f97387cf1ed097f9f1185ecb8d63d425.exe f97387cf1ed097f9f1185ecb8d63d425.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f97387cf1ed097f9f1185ecb8d63d425.exepid process 2136 f97387cf1ed097f9f1185ecb8d63d425.exe 2136 f97387cf1ed097f9f1185ecb8d63d425.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
f97387cf1ed097f9f1185ecb8d63d425.exepid process 228 f97387cf1ed097f9f1185ecb8d63d425.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
f97387cf1ed097f9f1185ecb8d63d425.exedescription pid process target process PID 228 wrote to memory of 2136 228 f97387cf1ed097f9f1185ecb8d63d425.exe f97387cf1ed097f9f1185ecb8d63d425.exe PID 228 wrote to memory of 2136 228 f97387cf1ed097f9f1185ecb8d63d425.exe f97387cf1ed097f9f1185ecb8d63d425.exe PID 228 wrote to memory of 2136 228 f97387cf1ed097f9f1185ecb8d63d425.exe f97387cf1ed097f9f1185ecb8d63d425.exe PID 228 wrote to memory of 2136 228 f97387cf1ed097f9f1185ecb8d63d425.exe f97387cf1ed097f9f1185ecb8d63d425.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f97387cf1ed097f9f1185ecb8d63d425.exe"C:\Users\Admin\AppData\Local\Temp\f97387cf1ed097f9f1185ecb8d63d425.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f97387cf1ed097f9f1185ecb8d63d425.exe"C:\Users\Admin\AppData\Local\Temp\f97387cf1ed097f9f1185ecb8d63d425.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/228-1-0x0000000000AE0000-0x0000000000BE0000-memory.dmpFilesize
1024KB
-
memory/228-2-0x0000000001480000-0x0000000001482000-memory.dmpFilesize
8KB
-
memory/2136-3-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2136-4-0x00000000013F0000-0x000000000173A000-memory.dmpFilesize
3.3MB