Analysis
-
max time kernel
121s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 14:43
Static task
static1
Behavioral task
behavioral1
Sample
3a2b189ba8182eb62ea6bfc27e8ca898.exe
Resource
win7-20231215-en
General
-
Target
3a2b189ba8182eb62ea6bfc27e8ca898.exe
-
Size
1.3MB
-
MD5
3a2b189ba8182eb62ea6bfc27e8ca898
-
SHA1
4dbb07cf112a88e1a90517102d281f12825d2c83
-
SHA256
f988c17ff348d65c83b031d164e3a3850b38f4e6b2c43cd426dfafd68474301a
-
SHA512
e73ce3cc077a7daecc58ad8b3de749cf19cc0f8e49c516f4fca3caeb0179073984df76a2113372131d7c3873f022d7210dce49d676913b12c615663cc4cf1460
-
SSDEEP
24576:rn+S/d3lYdkeDPEyZzgz8F59dbZt/SQIIgRmw2GPoN7vdiTbnFM:oRPE4zvF5nZt/DVgRmsPoiM
Malware Config
Extracted
xloader
2.3
wufn
rsautoluxe.com
theroseofsharonsalon.com
singnema.com
nathanielwhite108.com
theforumonline.com
iqpt.info
joneshondaservice.com
fafene.com
solanohomebuyerclass.com
zwq.xyz
searchlakeconroehomes.com
briative.com
frystmor.city
systemofyouth.com
sctsmney.com
tv-safetrading.com
thesweetboy.com
occulusblu.com
pawsthemomentpetphotography.com
travelstipsguide.com
verifypurchase.online
333s998.com
amsmapped.com
mimortgageexpert.com
joshuatreeresearch.com
brasilupshop.com
support24h.site
recipesdunnright.com
feathertiara.net
intoxickiss.com
greenmommarket.com
prinothhusky.com
800pls.info
martabaroagency.com
neosinder.com
davidwarburg.com
chinanl168.com
organicdiscover.com
kingdomvets.com
thetravellingwitch.com
kyg-cpa.com
bigarius.com
collegevillepaareahomes.com
ashestore.site
rizqebooks.com
techwhose.com
peak-valleyadvertising.com
craftbychristians.com
laterlifelendingsupermarket.com
setadragon.com
pon.xyz
reshemporium.com
missk-hair.com
hk6628.com
rootmoover.com
thetew.com
mybodysaver.com
cuadorcoast.com
goteclift.com
solisdq.info
hsicclassactionsettlement.com
cummingsforum.com
talleresmulticar.com
qq4004.com
gaigoilaocai.com
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral1/memory/2784-3-0x00000000004A0000-0x00000000004B2000-memory.dmp CustAttr -
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2148-12-0x0000000000400000-0x0000000000428000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3a2b189ba8182eb62ea6bfc27e8ca898.exedescription pid process target process PID 2784 set thread context of 2148 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
3a2b189ba8182eb62ea6bfc27e8ca898.exe3a2b189ba8182eb62ea6bfc27e8ca898.exepid process 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 2148 3a2b189ba8182eb62ea6bfc27e8ca898.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3a2b189ba8182eb62ea6bfc27e8ca898.exedescription pid process Token: SeDebugPrivilege 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
3a2b189ba8182eb62ea6bfc27e8ca898.exedescription pid process target process PID 2784 wrote to memory of 1092 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe PID 2784 wrote to memory of 1092 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe PID 2784 wrote to memory of 1092 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe PID 2784 wrote to memory of 1092 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe PID 2784 wrote to memory of 1716 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe PID 2784 wrote to memory of 1716 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe PID 2784 wrote to memory of 1716 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe PID 2784 wrote to memory of 1716 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe PID 2784 wrote to memory of 2012 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe PID 2784 wrote to memory of 2012 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe PID 2784 wrote to memory of 2012 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe PID 2784 wrote to memory of 2012 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe PID 2784 wrote to memory of 2148 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe PID 2784 wrote to memory of 2148 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe PID 2784 wrote to memory of 2148 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe PID 2784 wrote to memory of 2148 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe PID 2784 wrote to memory of 2148 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe PID 2784 wrote to memory of 2148 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe PID 2784 wrote to memory of 2148 2784 3a2b189ba8182eb62ea6bfc27e8ca898.exe 3a2b189ba8182eb62ea6bfc27e8ca898.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a2b189ba8182eb62ea6bfc27e8ca898.exe"C:\Users\Admin\AppData\Local\Temp\3a2b189ba8182eb62ea6bfc27e8ca898.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3a2b189ba8182eb62ea6bfc27e8ca898.exe"C:\Users\Admin\AppData\Local\Temp\3a2b189ba8182eb62ea6bfc27e8ca898.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\3a2b189ba8182eb62ea6bfc27e8ca898.exe"C:\Users\Admin\AppData\Local\Temp\3a2b189ba8182eb62ea6bfc27e8ca898.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a2b189ba8182eb62ea6bfc27e8ca898.exe"C:\Users\Admin\AppData\Local\Temp\3a2b189ba8182eb62ea6bfc27e8ca898.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a2b189ba8182eb62ea6bfc27e8ca898.exe"C:\Users\Admin\AppData\Local\Temp\3a2b189ba8182eb62ea6bfc27e8ca898.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2148-12-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2148-14-0x0000000000BB0000-0x0000000000EB3000-memory.dmpFilesize
3.0MB
-
memory/2148-8-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2148-9-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2148-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2784-3-0x00000000004A0000-0x00000000004B2000-memory.dmpFilesize
72KB
-
memory/2784-6-0x00000000059A0000-0x0000000005A3E000-memory.dmpFilesize
632KB
-
memory/2784-7-0x0000000001FC0000-0x0000000001FEE000-memory.dmpFilesize
184KB
-
memory/2784-13-0x0000000074D10000-0x00000000753FE000-memory.dmpFilesize
6.9MB
-
memory/2784-5-0x0000000004350000-0x0000000004390000-memory.dmpFilesize
256KB
-
memory/2784-4-0x0000000074D10000-0x00000000753FE000-memory.dmpFilesize
6.9MB
-
memory/2784-0-0x0000000074D10000-0x00000000753FE000-memory.dmpFilesize
6.9MB
-
memory/2784-2-0x0000000004350000-0x0000000004390000-memory.dmpFilesize
256KB
-
memory/2784-1-0x00000000001A0000-0x00000000002F4000-memory.dmpFilesize
1.3MB