Analysis
-
max time kernel
145s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 06:47
Static task
static1
Behavioral task
behavioral1
Sample
116824e0971300e9e2efe0f1c2d3f8c6.exe
Resource
win7-20231215-en
General
-
Target
116824e0971300e9e2efe0f1c2d3f8c6.exe
-
Size
527KB
-
MD5
116824e0971300e9e2efe0f1c2d3f8c6
-
SHA1
f5d38b9fc94e20f2dfed7b3e691ff65f7071bb65
-
SHA256
9f019f0bf99f5d64605c844792ed965f8be65b9378404c8792311ba56edd83cc
-
SHA512
78ac49e39f70d96b778aed2208962e0a222e19d0a1b7d438455a4aa474562d2e8be8fa29e90203cb99391468bd71fbd75a4f62495d12b6fac24a678cdca6d7f5
-
SSDEEP
12288:5hQVh9a17gNm5YnXDdx2OjKhNHySntn/jZF+xF/M+lNuXYQ5xOOahZwE:5hQVh9FDdx2GKzSStrKxF/MtHrah2E
Malware Config
Extracted
xloader
2.3
fznn
petmarketsolutions.com
themummymarketplace.com
themidnightcollectivepdx.com
detoxshake.site
ross76.com
tom-tours2020.com
domoservis.com
allcombuildingsvc.com
padelshop.online
wosaying.com
heafg.com
inglesbrasileiro.com
santaclausonline.net
voiceofmagic.com
lafayettelc.com
communal-sleeve.net
extremecouponing.online
mypomate.com
rtdrillbit.com
therealtortaylor.com
yiyft.com
step-shoes.xyz
500brickellcondos.com
sserignou.com
rosiesmixologybartendingllc.com
savealotswfl.com
magetu.info
airboatcolombia.com
geezop.com
dadaoliangpi.com
jane-woolrich.net
detroit3dp.com
masonandmadyn.com
tformit.com
reyting-foreks.com
faszination-wetter.com
haneul.life
sweetiefilms.com
sellmyhomequicktampa.com
jvxez.com
laurawiercinska.com
demoattorney.com
clc-24.com
corruptoefrenmartinez.com
cosmicgeneralstore.com
nobel.ink
officeactivate.xyz
beevenomoil.com
1ow.life
kamilahtomlinson.com
xnr-market.com
interactivecommons.com
tonyjmarketinghelp.com
creativinet.com
aiministor.com
lavishladys.com
kingzrus.com
9066985.com
milayapi.net
haoshuo88.com
629310.com
activasigurari.xyz
pornera.xyz
wallawander.com
designsbynandini.com
Signatures
-
Xloader payload 1 IoCs
resource yara_rule behavioral2/memory/2992-2-0x0000000000360000-0x0000000000388000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1448 set thread context of 2992 1448 116824e0971300e9e2efe0f1c2d3f8c6.exe 88 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2992 116824e0971300e9e2efe0f1c2d3f8c6.exe 2992 116824e0971300e9e2efe0f1c2d3f8c6.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1448 116824e0971300e9e2efe0f1c2d3f8c6.exe 1448 116824e0971300e9e2efe0f1c2d3f8c6.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1448 wrote to memory of 2992 1448 116824e0971300e9e2efe0f1c2d3f8c6.exe 88 PID 1448 wrote to memory of 2992 1448 116824e0971300e9e2efe0f1c2d3f8c6.exe 88 PID 1448 wrote to memory of 2992 1448 116824e0971300e9e2efe0f1c2d3f8c6.exe 88 PID 1448 wrote to memory of 2992 1448 116824e0971300e9e2efe0f1c2d3f8c6.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\116824e0971300e9e2efe0f1c2d3f8c6.exe"C:\Users\Admin\AppData\Local\Temp\116824e0971300e9e2efe0f1c2d3f8c6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\116824e0971300e9e2efe0f1c2d3f8c6.exe"C:\Users\Admin\AppData\Local\Temp\116824e0971300e9e2efe0f1c2d3f8c6.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2992
-