Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2024, 19:20
Static task
static1
Behavioral task
behavioral1
Sample
495a3851285b29a43693cf5a93516608.exe
Resource
win7-20231215-en
General
-
Target
495a3851285b29a43693cf5a93516608.exe
-
Size
1.2MB
-
MD5
495a3851285b29a43693cf5a93516608
-
SHA1
7ef194179534a1d0a1a7aa4aacd504c0f6e05853
-
SHA256
d4dbb398a31310583837a0e3152c739f965ecf44c01e0aacd0249a85630d88be
-
SHA512
2e7f7849d731f69007f5b80a71b6981c88b110a086ef655b556f59b9f2cc892c453c9b921dc7d9c6646c191737f222c88d5060e0d9d160f57ef1c9f5bbdbd9c3
-
SSDEEP
24576:xDS/d3BKzksPks2y8jeLELZ7UuyvA1MN7ZNZZ:AKquLEF7UzvbN7ZNZ
Malware Config
Extracted
xloader
2.3
wufn
rsautoluxe.com
theroseofsharonsalon.com
singnema.com
nathanielwhite108.com
theforumonline.com
iqpt.info
joneshondaservice.com
fafene.com
solanohomebuyerclass.com
zwq.xyz
searchlakeconroehomes.com
briative.com
frystmor.city
systemofyouth.com
sctsmney.com
tv-safetrading.com
thesweetboy.com
occulusblu.com
pawsthemomentpetphotography.com
travelstipsguide.com
verifypurchase.online
333s998.com
amsmapped.com
mimortgageexpert.com
joshuatreeresearch.com
brasilupshop.com
support24h.site
recipesdunnright.com
feathertiara.net
intoxickiss.com
greenmommarket.com
prinothhusky.com
800pls.info
martabaroagency.com
neosinder.com
davidwarburg.com
chinanl168.com
organicdiscover.com
kingdomvets.com
thetravellingwitch.com
kyg-cpa.com
bigarius.com
collegevillepaareahomes.com
ashestore.site
rizqebooks.com
techwhose.com
peak-valleyadvertising.com
craftbychristians.com
laterlifelendingsupermarket.com
setadragon.com
pon.xyz
reshemporium.com
missk-hair.com
hk6628.com
rootmoover.com
thetew.com
mybodysaver.com
cuadorcoast.com
goteclift.com
solisdq.info
hsicclassactionsettlement.com
cummingsforum.com
talleresmulticar.com
qq4004.com
gaigoilaocai.com
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
resource yara_rule behavioral2/memory/752-7-0x00000000059C0000-0x00000000059D2000-memory.dmp CustAttr -
Xloader payload 1 IoCs
resource yara_rule behavioral2/memory/452-12-0x0000000000400000-0x0000000000428000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 752 set thread context of 452 752 495a3851285b29a43693cf5a93516608.exe 104 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 752 495a3851285b29a43693cf5a93516608.exe 752 495a3851285b29a43693cf5a93516608.exe 452 495a3851285b29a43693cf5a93516608.exe 452 495a3851285b29a43693cf5a93516608.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 752 495a3851285b29a43693cf5a93516608.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 752 wrote to memory of 1784 752 495a3851285b29a43693cf5a93516608.exe 103 PID 752 wrote to memory of 1784 752 495a3851285b29a43693cf5a93516608.exe 103 PID 752 wrote to memory of 1784 752 495a3851285b29a43693cf5a93516608.exe 103 PID 752 wrote to memory of 452 752 495a3851285b29a43693cf5a93516608.exe 104 PID 752 wrote to memory of 452 752 495a3851285b29a43693cf5a93516608.exe 104 PID 752 wrote to memory of 452 752 495a3851285b29a43693cf5a93516608.exe 104 PID 752 wrote to memory of 452 752 495a3851285b29a43693cf5a93516608.exe 104 PID 752 wrote to memory of 452 752 495a3851285b29a43693cf5a93516608.exe 104 PID 752 wrote to memory of 452 752 495a3851285b29a43693cf5a93516608.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\495a3851285b29a43693cf5a93516608.exe"C:\Users\Admin\AppData\Local\Temp\495a3851285b29a43693cf5a93516608.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\495a3851285b29a43693cf5a93516608.exe"C:\Users\Admin\AppData\Local\Temp\495a3851285b29a43693cf5a93516608.exe"2⤵PID:1784
-
-
C:\Users\Admin\AppData\Local\Temp\495a3851285b29a43693cf5a93516608.exe"C:\Users\Admin\AppData\Local\Temp\495a3851285b29a43693cf5a93516608.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:452
-