Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
11-01-2024 14:09
Behavioral task
behavioral1
Sample
53b8c0b31af3ba5de658c119e39f73bc.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
53b8c0b31af3ba5de658c119e39f73bc.exe
Resource
win10v2004-20231215-en
General
-
Target
53b8c0b31af3ba5de658c119e39f73bc.exe
-
Size
585KB
-
MD5
53b8c0b31af3ba5de658c119e39f73bc
-
SHA1
946d13ae1bcc275b3b1e3542b08f04803a93b50a
-
SHA256
4311e97e616734f94d1aa4d38f37679749ae84513d132aee134fbc364d25b6ec
-
SHA512
a2963aeca88f486c519fec957878616182c62ff7fb5f2fda36816678594a4b54192abe56088666328142ddef7479621222de66c5e74a52f69f9756463e417436
-
SSDEEP
12288:WXe9PPlowWX0t6mOQwg1Qd15CcYk0We10dOi0I9xkhHnSumVWvc/dNNcEUKc:rhloDX0XOf4pI9mhHisENWj
Malware Config
Extracted
xloader
2.3
noi6
yow.today
rkdreamcreations.com
etheriumtech.com
stretchwrench.com
kiddiecruise.com
stickforward.com
videocineproduccion.com
roofinginamerica.com
amarillasnuevomexico.com
armfieldmillerripley.com
macyburn.club
lvbaoshan.com
shopshelponline.com
thebunnybrands.com
newsxplor.com
momunani.com
rebelnqueen.com
tusguitarras.com
nexab2b.com
e3office.express
restpostenboerse.com
empdx.net
treekium.com
kuyumcusigortasi.com
icufashionaccessories.com
olv.design
vraniqi-plast.com
metalate.com
salondelalocura.com
parivarthanarchitects.com
lovewithjanel.community
thelifeprotectgroup.com
tukangphoto.com
seguridadcusaem.com
europeisawesome.com
celinbag.com
e-basvuru-hizmetleri.com
myfojwinx.icu
wecamptee.com
weihang0769.com
onlinecolorization.com
vaccinocovid19.info
novastreaming.net
menuhaliving.com
gayderjoes.com
pantysniffershop.com
powerbie.com
naplesebike.com
chipinsideyourbrain.com
thegioicaytrongnha.com
downtowntallyretreat.com
latiaov.net
albanyfence.com
ttzya.com
jvillehatchery.com
shaonix.com
swaphomeloans.com
hotelsasian.com
truckcar.info
papocabecaepescoco.net
dekodizajn.com
bulukx.com
turbochargeyourwriting.com
lcscards-veilig.icu
offshoresrilanka.com
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2032-10-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Processes:
resource yara_rule behavioral1/memory/2956-0-0x0000000000400000-0x0000000000554000-memory.dmp upx behavioral1/memory/2956-11-0x0000000000400000-0x0000000000554000-memory.dmp upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2956-11-0x0000000000400000-0x0000000000554000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
53b8c0b31af3ba5de658c119e39f73bc.exepid process 2956 53b8c0b31af3ba5de658c119e39f73bc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
53b8c0b31af3ba5de658c119e39f73bc.exedescription pid process target process PID 2956 wrote to memory of 2032 2956 53b8c0b31af3ba5de658c119e39f73bc.exe 53b8c0b31af3ba5de658c119e39f73bc.exe PID 2956 wrote to memory of 2032 2956 53b8c0b31af3ba5de658c119e39f73bc.exe 53b8c0b31af3ba5de658c119e39f73bc.exe PID 2956 wrote to memory of 2032 2956 53b8c0b31af3ba5de658c119e39f73bc.exe 53b8c0b31af3ba5de658c119e39f73bc.exe PID 2956 wrote to memory of 2032 2956 53b8c0b31af3ba5de658c119e39f73bc.exe 53b8c0b31af3ba5de658c119e39f73bc.exe PID 2956 wrote to memory of 2032 2956 53b8c0b31af3ba5de658c119e39f73bc.exe 53b8c0b31af3ba5de658c119e39f73bc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53b8c0b31af3ba5de658c119e39f73bc.exe"C:\Users\Admin\AppData\Local\Temp\53b8c0b31af3ba5de658c119e39f73bc.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\53b8c0b31af3ba5de658c119e39f73bc.exe"C:\Users\Admin\AppData\Local\Temp\53b8c0b31af3ba5de658c119e39f73bc.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\oynspbvpsrorFilesize
216KB
MD50fe362b1c6d19ce9a16a63a18b31235c
SHA100201f7b6d9b2d1f7b0c05ff2ff64b041bb80dda
SHA25601d97f5906f0ddb907de1e6d72358977c524fa4c49e847d22a6a3be3e4438ce8
SHA5123c2ee0179f6a198f9b7eb88f0753eb70911f90e6291328a0c431122c84dfb02e0c2f122c5a16ac8dfbb6526dd6595e0e392db7791f25e3dd565455915f0d9aff
-
memory/2032-10-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2956-0-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/2956-11-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/2956-9-0x0000000003630000-0x0000000003784000-memory.dmpFilesize
1.3MB
-
memory/2956-8-0x0000000000990000-0x0000000000992000-memory.dmpFilesize
8KB
-
memory/2956-7-0x0000000000980000-0x0000000000981000-memory.dmpFilesize
4KB