Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
15-02-2024 22:42
Static task
static1
Behavioral task
behavioral1
Sample
9ec36a263e339b95d1c21ab7234372a5.exe
Resource
win7-20231215-en
General
-
Target
9ec36a263e339b95d1c21ab7234372a5.exe
-
Size
1.5MB
-
MD5
9ec36a263e339b95d1c21ab7234372a5
-
SHA1
29d6d78a8205cc7e7a7e565677fc697f09573d5d
-
SHA256
940ee40d0ea9f6a02abe1f52323341d70a4b5ee4fb8135a1711a45024f927b60
-
SHA512
635a31e716a8078c8f80e299746d806120a7b673cbfce70c665537992e4b2fb38373ae5faf488d1aba92d5438d1d93c2c12f894d46b38ed80aa6384fb41f5776
-
SSDEEP
12288:Pn32WV51OMAEjywW+8ehqmtgfZMYxQouJhYRI8RbCQ6H+Uy1Susr8MmH3jnS:/zz1O0mwRdqmGBMMQZhYRfF/ZZS5R0
Malware Config
Extracted
xloader
2.3
be4o
gosth-kitchen.com
300coin.club
mdseenergys.com
weizhong.asia
pixorum.com
rdchicken.com
beverlyhills-mc.com
voteelliot.com
noithatsongtung.com
bestiepetinsurance.net
pannacottagames.com
materaweddings.com
kryodry.com
hardlikeaboss.com
fnhope.com
blun33.com
rentmystuff.pro
maimaimaoba.com
caneteperu.com
lata-gouveia.com
algacpe.com
butoocnc.com
rejallacloud.com
dreamboatco.com
arielpt.com
globeairmx.com
exceptionalrenovationscorps.com
thehustlern.com
jbfalandays.net
stadefrancaisparis.com
silverimagestudios.com
firebirdpodcast.com
6jianwang.com
teasyou.com
blackflytienda.com
jslkdq88.com
omegaceviz.xyz
hbcuwomenlead.com
erectumupper.com
rishushrivastava.com
greatestmeacademy.com
karmartbuybackevent.com
bossbussy.com
theclevelandhouses.com
strangefruit.world
marijuanachoices.com
thedarkmatterseries.com
lasantaclothing.com
advogadosmmf.com
fahlstromfarms.com
sandiegogullshockey.com
sanhuting.com
myetricks.com
sowingpen.com
xmuhasebe.com
prolyricss.com
hendrickson-remodeling.com
flufftopia.info
fiestajoy.com
behcomedikal.com
enterpressence.com
retrofrolic.com
amazon-i3.com
imi93.com
wapteas.com
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2544-13-0x0000000000400000-0x0000000000428000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9ec36a263e339b95d1c21ab7234372a5.exedescription pid process target process PID 1040 set thread context of 2544 1040 9ec36a263e339b95d1c21ab7234372a5.exe 9ec36a263e339b95d1c21ab7234372a5.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1996 2544 WerFault.exe 9ec36a263e339b95d1c21ab7234372a5.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
9ec36a263e339b95d1c21ab7234372a5.exepid process 1040 9ec36a263e339b95d1c21ab7234372a5.exe 1040 9ec36a263e339b95d1c21ab7234372a5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
9ec36a263e339b95d1c21ab7234372a5.exedescription pid process Token: SeDebugPrivilege 1040 9ec36a263e339b95d1c21ab7234372a5.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
9ec36a263e339b95d1c21ab7234372a5.exe9ec36a263e339b95d1c21ab7234372a5.exedescription pid process target process PID 1040 wrote to memory of 2548 1040 9ec36a263e339b95d1c21ab7234372a5.exe 9ec36a263e339b95d1c21ab7234372a5.exe PID 1040 wrote to memory of 2548 1040 9ec36a263e339b95d1c21ab7234372a5.exe 9ec36a263e339b95d1c21ab7234372a5.exe PID 1040 wrote to memory of 2548 1040 9ec36a263e339b95d1c21ab7234372a5.exe 9ec36a263e339b95d1c21ab7234372a5.exe PID 1040 wrote to memory of 2548 1040 9ec36a263e339b95d1c21ab7234372a5.exe 9ec36a263e339b95d1c21ab7234372a5.exe PID 1040 wrote to memory of 2544 1040 9ec36a263e339b95d1c21ab7234372a5.exe 9ec36a263e339b95d1c21ab7234372a5.exe PID 1040 wrote to memory of 2544 1040 9ec36a263e339b95d1c21ab7234372a5.exe 9ec36a263e339b95d1c21ab7234372a5.exe PID 1040 wrote to memory of 2544 1040 9ec36a263e339b95d1c21ab7234372a5.exe 9ec36a263e339b95d1c21ab7234372a5.exe PID 1040 wrote to memory of 2544 1040 9ec36a263e339b95d1c21ab7234372a5.exe 9ec36a263e339b95d1c21ab7234372a5.exe PID 1040 wrote to memory of 2544 1040 9ec36a263e339b95d1c21ab7234372a5.exe 9ec36a263e339b95d1c21ab7234372a5.exe PID 1040 wrote to memory of 2544 1040 9ec36a263e339b95d1c21ab7234372a5.exe 9ec36a263e339b95d1c21ab7234372a5.exe PID 1040 wrote to memory of 2544 1040 9ec36a263e339b95d1c21ab7234372a5.exe 9ec36a263e339b95d1c21ab7234372a5.exe PID 2544 wrote to memory of 1996 2544 9ec36a263e339b95d1c21ab7234372a5.exe WerFault.exe PID 2544 wrote to memory of 1996 2544 9ec36a263e339b95d1c21ab7234372a5.exe WerFault.exe PID 2544 wrote to memory of 1996 2544 9ec36a263e339b95d1c21ab7234372a5.exe WerFault.exe PID 2544 wrote to memory of 1996 2544 9ec36a263e339b95d1c21ab7234372a5.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ec36a263e339b95d1c21ab7234372a5.exe"C:\Users\Admin\AppData\Local\Temp\9ec36a263e339b95d1c21ab7234372a5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9ec36a263e339b95d1c21ab7234372a5.exe"C:\Users\Admin\AppData\Local\Temp\9ec36a263e339b95d1c21ab7234372a5.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\9ec36a263e339b95d1c21ab7234372a5.exe"C:\Users\Admin\AppData\Local\Temp\9ec36a263e339b95d1c21ab7234372a5.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 363⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1040-6-0x0000000005810000-0x00000000058B0000-memory.dmpFilesize
640KB
-
memory/1040-0-0x0000000000F00000-0x000000000108A000-memory.dmpFilesize
1.5MB
-
memory/1040-2-0x00000000008A0000-0x00000000008E0000-memory.dmpFilesize
256KB
-
memory/1040-3-0x00000000008E0000-0x00000000008FE000-memory.dmpFilesize
120KB
-
memory/1040-4-0x0000000074380000-0x0000000074A6E000-memory.dmpFilesize
6.9MB
-
memory/1040-5-0x00000000008A0000-0x00000000008E0000-memory.dmpFilesize
256KB
-
memory/1040-1-0x0000000074380000-0x0000000074A6E000-memory.dmpFilesize
6.9MB
-
memory/1040-7-0x0000000000ED0000-0x0000000000EFE000-memory.dmpFilesize
184KB
-
memory/1040-14-0x0000000074380000-0x0000000074A6E000-memory.dmpFilesize
6.9MB
-
memory/2544-8-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2544-10-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2544-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2544-13-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB