Analysis
-
max time kernel
140s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 01:57
Static task
static1
Behavioral task
behavioral1
Sample
23962f311cb6016e8f5a84ceb3bab011.exe
Resource
win7-20231215-en
General
-
Target
23962f311cb6016e8f5a84ceb3bab011.exe
-
Size
936KB
-
MD5
23962f311cb6016e8f5a84ceb3bab011
-
SHA1
684290eac2e8dab2b2f3d7d3e598cc87306c1840
-
SHA256
1086e2faa19287c271b669be3118a0509f3547cbe638e7f783d0c691be084be8
-
SHA512
b38324d8d0ef841dd536cd04aa8fb04975353bd7cdde56553ae298cbc743200e0c40e48c36d1c66802a8cce1caf051d7a62d7fbc3be9aafa3950e263318699f3
-
SSDEEP
24576:zTd8cS/d3YK64J3S0R5z2xICwcQo1+HisZzoH:HBK64Ji0R12Ce1KFzo
Malware Config
Extracted
xloader
2.3
wufn
rsautoluxe.com
theroseofsharonsalon.com
singnema.com
nathanielwhite108.com
theforumonline.com
iqpt.info
joneshondaservice.com
fafene.com
solanohomebuyerclass.com
zwq.xyz
searchlakeconroehomes.com
briative.com
frystmor.city
systemofyouth.com
sctsmney.com
tv-safetrading.com
thesweetboy.com
occulusblu.com
pawsthemomentpetphotography.com
travelstipsguide.com
verifypurchase.online
333s998.com
amsmapped.com
mimortgageexpert.com
joshuatreeresearch.com
brasilupshop.com
support24h.site
recipesdunnright.com
feathertiara.net
intoxickiss.com
greenmommarket.com
prinothhusky.com
800pls.info
martabaroagency.com
neosinder.com
davidwarburg.com
chinanl168.com
organicdiscover.com
kingdomvets.com
thetravellingwitch.com
kyg-cpa.com
bigarius.com
collegevillepaareahomes.com
ashestore.site
rizqebooks.com
techwhose.com
peak-valleyadvertising.com
craftbychristians.com
laterlifelendingsupermarket.com
setadragon.com
pon.xyz
reshemporium.com
missk-hair.com
hk6628.com
rootmoover.com
thetew.com
mybodysaver.com
cuadorcoast.com
goteclift.com
solisdq.info
hsicclassactionsettlement.com
cummingsforum.com
talleresmulticar.com
qq4004.com
gaigoilaocai.com
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral2/memory/4528-8-0x0000000005BD0000-0x0000000005BE2000-memory.dmp CustAttr -
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2512-13-0x0000000000400000-0x0000000000428000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
23962f311cb6016e8f5a84ceb3bab011.exedescription pid process target process PID 4528 set thread context of 2512 4528 23962f311cb6016e8f5a84ceb3bab011.exe 23962f311cb6016e8f5a84ceb3bab011.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
23962f311cb6016e8f5a84ceb3bab011.exepid process 2512 23962f311cb6016e8f5a84ceb3bab011.exe 2512 23962f311cb6016e8f5a84ceb3bab011.exe 2512 23962f311cb6016e8f5a84ceb3bab011.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
23962f311cb6016e8f5a84ceb3bab011.exedescription pid process target process PID 4528 wrote to memory of 2512 4528 23962f311cb6016e8f5a84ceb3bab011.exe 23962f311cb6016e8f5a84ceb3bab011.exe PID 4528 wrote to memory of 2512 4528 23962f311cb6016e8f5a84ceb3bab011.exe 23962f311cb6016e8f5a84ceb3bab011.exe PID 4528 wrote to memory of 2512 4528 23962f311cb6016e8f5a84ceb3bab011.exe 23962f311cb6016e8f5a84ceb3bab011.exe PID 4528 wrote to memory of 2512 4528 23962f311cb6016e8f5a84ceb3bab011.exe 23962f311cb6016e8f5a84ceb3bab011.exe PID 4528 wrote to memory of 2512 4528 23962f311cb6016e8f5a84ceb3bab011.exe 23962f311cb6016e8f5a84ceb3bab011.exe PID 4528 wrote to memory of 2512 4528 23962f311cb6016e8f5a84ceb3bab011.exe 23962f311cb6016e8f5a84ceb3bab011.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23962f311cb6016e8f5a84ceb3bab011.exe"C:\Users\Admin\AppData\Local\Temp\23962f311cb6016e8f5a84ceb3bab011.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\23962f311cb6016e8f5a84ceb3bab011.exe"C:\Users\Admin\AppData\Local\Temp\23962f311cb6016e8f5a84ceb3bab011.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2512-13-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2512-17-0x00000000011A0000-0x00000000014EA000-memory.dmpFilesize
3.3MB
-
memory/2512-16-0x00000000011A0000-0x00000000014EA000-memory.dmpFilesize
3.3MB
-
memory/4528-1-0x0000000074620000-0x0000000074DD0000-memory.dmpFilesize
7.7MB
-
memory/4528-10-0x0000000005640000-0x0000000005650000-memory.dmpFilesize
64KB
-
memory/4528-0-0x0000000000B00000-0x0000000000BF0000-memory.dmpFilesize
960KB
-
memory/4528-7-0x00000000058C0000-0x0000000005916000-memory.dmpFilesize
344KB
-
memory/4528-6-0x0000000005690000-0x000000000569A000-memory.dmpFilesize
40KB
-
memory/4528-8-0x0000000005BD0000-0x0000000005BE2000-memory.dmpFilesize
72KB
-
memory/4528-9-0x0000000074620000-0x0000000074DD0000-memory.dmpFilesize
7.7MB
-
memory/4528-2-0x0000000005560000-0x00000000055FC000-memory.dmpFilesize
624KB
-
memory/4528-11-0x0000000006DD0000-0x0000000006E48000-memory.dmpFilesize
480KB
-
memory/4528-5-0x0000000005640000-0x0000000005650000-memory.dmpFilesize
64KB
-
memory/4528-15-0x0000000074620000-0x0000000074DD0000-memory.dmpFilesize
7.7MB
-
memory/4528-4-0x0000000005730000-0x00000000057C2000-memory.dmpFilesize
584KB
-
memory/4528-12-0x0000000006E60000-0x0000000006E90000-memory.dmpFilesize
192KB
-
memory/4528-3-0x0000000005C40000-0x00000000061E4000-memory.dmpFilesize
5.6MB