Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28-12-2023 21:05
Static task
static1
Behavioral task
behavioral1
Sample
f826defd978e74a09d47ad5cbe2a6c93.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f826defd978e74a09d47ad5cbe2a6c93.exe
Resource
win10v2004-20231222-en
General
-
Target
f826defd978e74a09d47ad5cbe2a6c93.exe
-
Size
347KB
-
MD5
f826defd978e74a09d47ad5cbe2a6c93
-
SHA1
6892b6ebc8301ac535af2391aa0563453082fa4f
-
SHA256
2aa4e557d70c43b63c4c83dae89a00b09ded7c16317a30cce69d8b44c4ae2c2d
-
SHA512
44f3e9d07b4b520a5004c11ff903fa2868a423d062fc5f18c7faf0b45343d593db75a36b4585729b95488616a490af1facb66ad98a2d5f061b78021ba9f1c811
-
SSDEEP
6144:pF49qqKGPBcwqh3SBYA4444444444444BffIq2DPzY1vPT+hn7kg46meJl+Ku:pzvGPOEYdfvEzY56kumeJl+x
Malware Config
Extracted
xloader
2.3
b6a4
reviewsresolutions.com
binhminhgardenshophouse.com
nebulacom.com
kadhambaristudio.com
viltoom.club
supmomma.com
tjszxddc.com
darlingmemories.com
hyperultrapure.com
vibembrio.com
reallycoolmask.com
cumbukita.com
brian-newby.com
abstractaccessories.com
marykinky.com
minnesotareversemtgloans.com
prasetlement.com
xplpgi.com
xn--gdask-y7a.com
uababaseball.com
intesmartscale.com
hmwcin.com
pavel-levakov.com
esmebonnell.com
hdyfworldwide.com
shanghaino1milpitas.com
abrosnm3.com
millenialife.info
cgfia.com
sk275.com
anwaltmaier.wien
adminlagu.com
halaltory.com
ketofoodfight.club
mossymilecouture.com
toinfinityandabroad.com
goldstreamradio.com
hs-ciq.net
shedajackson.com
kussharoko.net
superpackersmovers.com
thecarbonbox.store
kayfkitchen.com
remedicore.com
zfozxr.icu
bloodbluemoons.com
vistaonlinedemo.com
tucirculodeideas.com
saanythinghealth.com
codenevisi.com
pickyclick.com
streammsex.com
ledtorchtr.com
louisgrech.com
realdocumentsforsale.com
compragospel.com
starlet5.xyz
phasmaelectro.com
kos-living.com
casamattapm.com
ievapavulane.com
wakeupwithfreedom.com
matkomiljevic.com
leonaprojects.com
miraculousventures.com
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2224-3-0x0000000000400000-0x0000000000428000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f826defd978e74a09d47ad5cbe2a6c93.exedescription pid process target process PID 2532 set thread context of 2224 2532 f826defd978e74a09d47ad5cbe2a6c93.exe f826defd978e74a09d47ad5cbe2a6c93.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
f826defd978e74a09d47ad5cbe2a6c93.exepid process 2224 f826defd978e74a09d47ad5cbe2a6c93.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
f826defd978e74a09d47ad5cbe2a6c93.exepid process 2532 f826defd978e74a09d47ad5cbe2a6c93.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
f826defd978e74a09d47ad5cbe2a6c93.exedescription pid process target process PID 2532 wrote to memory of 2224 2532 f826defd978e74a09d47ad5cbe2a6c93.exe f826defd978e74a09d47ad5cbe2a6c93.exe PID 2532 wrote to memory of 2224 2532 f826defd978e74a09d47ad5cbe2a6c93.exe f826defd978e74a09d47ad5cbe2a6c93.exe PID 2532 wrote to memory of 2224 2532 f826defd978e74a09d47ad5cbe2a6c93.exe f826defd978e74a09d47ad5cbe2a6c93.exe PID 2532 wrote to memory of 2224 2532 f826defd978e74a09d47ad5cbe2a6c93.exe f826defd978e74a09d47ad5cbe2a6c93.exe PID 2532 wrote to memory of 2224 2532 f826defd978e74a09d47ad5cbe2a6c93.exe f826defd978e74a09d47ad5cbe2a6c93.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f826defd978e74a09d47ad5cbe2a6c93.exe"C:\Users\Admin\AppData\Local\Temp\f826defd978e74a09d47ad5cbe2a6c93.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f826defd978e74a09d47ad5cbe2a6c93.exe"C:\Users\Admin\AppData\Local\Temp\f826defd978e74a09d47ad5cbe2a6c93.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2224-3-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2224-6-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/2532-1-0x0000000000090000-0x0000000000190000-memory.dmpFilesize
1024KB
-
memory/2532-2-0x0000000000280000-0x0000000000282000-memory.dmpFilesize
8KB