Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 16:55
Static task
static1
Behavioral task
behavioral1
Sample
3a91f6caa3965066b881d1de7a67f1b9.exe
Resource
win7-20231129-en
General
-
Target
3a91f6caa3965066b881d1de7a67f1b9.exe
-
Size
680KB
-
MD5
3a91f6caa3965066b881d1de7a67f1b9
-
SHA1
6097fcf7687e0ec485eae2d57cf9b993ab520375
-
SHA256
3085d62628657edccc65a18edda86f253fb86712a4e50b1cf67828bfa2d33e80
-
SHA512
516b5704221bc49d607b80bafd6841976019f908869449c97f6a27c2840d43f62c76af2c5e464fb6b3f04079045b95883d3ed7fd684be1a269ec1663ba2b2dfb
-
SSDEEP
6144:SDnzTkV5gplawjJlNbno7QCGyfVENB+r5XmLXGZEKr042gBHL3Q9I5Oup:4nxawjlnAVfVIBc5XmL2O42gBHDQ9WN
Malware Config
Extracted
xloader
2.3
k8b5
sardamedicals.com
reelectkendavis4council.com
coreconsultation.com
fajarazhary.com
mybitearner.com
brightpet.info
voicewithchoice.com
bailbondscompany.xyz
7133333333.com
delights.info
gawlvegdr.icu
sdqhpm.com
we2savvyok.com
primallifeathlete.com
gdsinglecell.com
isokineticmachines.com
smartneckrelax.com
gardenvintage.com
hiphopvolume.com
medicapoint.com
crybebe.com
elevatedgameplay.com
armespublishing.com
pathsiteofficial.com
xn--e-2fa.com
besoxie.com
pro-montage.com
smartsmsfloan.net
gafinstallations.com
osk2279.com
sexcam-live-sex.net
supermomsd.com
villa-sardi.com
nkb-webmart.com
vaaccidentdoctorsnearme.net
sewcialdistancesewing.com
smodery.com
mimik33.com
employeepremiumassistance.com
chenqixuan.com
whyyousuckatgolfmovie.com
scholarshdesk.xyz
suenosenescena.com
ombaked.com
growingbargains.com
growbigelite.com
michalwroblewski.online
selfpublishingprojectmgmt.com
salir.info
lutherdanavan.com
caraccidentlawyernearme.net
portraitverse.com
secure-alerts901.info
reviewscanada.com
andreasaction.com
mblinks.net
regulationtoshop.com
borderless-farm.com
excitingdailyshop.com
pawandalmia.net
greatplainsjane.com
operacionapoyo.com
26gibraltardrive.com
getportlandjustice.com
chongzhi365.com
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2588-14-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3a91f6caa3965066b881d1de7a67f1b9.exedescription pid process target process PID 2188 set thread context of 2588 2188 3a91f6caa3965066b881d1de7a67f1b9.exe 3a91f6caa3965066b881d1de7a67f1b9.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3a91f6caa3965066b881d1de7a67f1b9.exepid process 2588 3a91f6caa3965066b881d1de7a67f1b9.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
3a91f6caa3965066b881d1de7a67f1b9.exedescription pid process target process PID 2188 wrote to memory of 2588 2188 3a91f6caa3965066b881d1de7a67f1b9.exe 3a91f6caa3965066b881d1de7a67f1b9.exe PID 2188 wrote to memory of 2588 2188 3a91f6caa3965066b881d1de7a67f1b9.exe 3a91f6caa3965066b881d1de7a67f1b9.exe PID 2188 wrote to memory of 2588 2188 3a91f6caa3965066b881d1de7a67f1b9.exe 3a91f6caa3965066b881d1de7a67f1b9.exe PID 2188 wrote to memory of 2588 2188 3a91f6caa3965066b881d1de7a67f1b9.exe 3a91f6caa3965066b881d1de7a67f1b9.exe PID 2188 wrote to memory of 2588 2188 3a91f6caa3965066b881d1de7a67f1b9.exe 3a91f6caa3965066b881d1de7a67f1b9.exe PID 2188 wrote to memory of 2588 2188 3a91f6caa3965066b881d1de7a67f1b9.exe 3a91f6caa3965066b881d1de7a67f1b9.exe PID 2188 wrote to memory of 2588 2188 3a91f6caa3965066b881d1de7a67f1b9.exe 3a91f6caa3965066b881d1de7a67f1b9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a91f6caa3965066b881d1de7a67f1b9.exe"C:\Users\Admin\AppData\Local\Temp\3a91f6caa3965066b881d1de7a67f1b9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3a91f6caa3965066b881d1de7a67f1b9.exe"C:\Users\Admin\AppData\Local\Temp\3a91f6caa3965066b881d1de7a67f1b9.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2188-6-0x00000000056A0000-0x0000000005706000-memory.dmpFilesize
408KB
-
memory/2188-1-0x0000000074690000-0x0000000074D7E000-memory.dmpFilesize
6.9MB
-
memory/2188-2-0x0000000004F30000-0x0000000004F70000-memory.dmpFilesize
256KB
-
memory/2188-3-0x0000000000450000-0x000000000046C000-memory.dmpFilesize
112KB
-
memory/2188-4-0x0000000074690000-0x0000000074D7E000-memory.dmpFilesize
6.9MB
-
memory/2188-5-0x0000000004F30000-0x0000000004F70000-memory.dmpFilesize
256KB
-
memory/2188-0-0x0000000000C20000-0x0000000000CD0000-memory.dmpFilesize
704KB
-
memory/2188-7-0x0000000000BA0000-0x0000000000BD0000-memory.dmpFilesize
192KB
-
memory/2188-15-0x0000000074690000-0x0000000074D7E000-memory.dmpFilesize
6.9MB
-
memory/2588-14-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2588-16-0x0000000000860000-0x0000000000B63000-memory.dmpFilesize
3.0MB
-
memory/2588-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2588-10-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2588-8-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB