Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 22:30
Static task
static1
Behavioral task
behavioral1
Sample
3d2aeedacfc41b9882494188059bcf1c81160920d4e83fc1f604d0381bca9ea7.exe
Resource
win7-20241010-en
General
-
Target
3d2aeedacfc41b9882494188059bcf1c81160920d4e83fc1f604d0381bca9ea7.exe
-
Size
892KB
-
MD5
4c19f4bccaada36995fb7f26629df873
-
SHA1
8c04357daf3d64a5f2fac82310472273d46373ac
-
SHA256
3d2aeedacfc41b9882494188059bcf1c81160920d4e83fc1f604d0381bca9ea7
-
SHA512
42c48f74ba8a194982c96623e0348d49f96768d1115ad9ce22a1db6221b1165e1de722d8c41ab34292117f3efe81007240d7f284fcca929f8dad4dc7e536705f
-
SSDEEP
24576:Dwpoi9hGoNIEooPVkAUQBEXPrFx8clMEmsx:DaqEoSBwfcOMEv
Malware Config
Extracted
xloader
2.5
m8gc
nelsonleeoffers.com
profi-markets.com
bdstoancau.info
aminsfy.com
longshifa.online
sqadminnplan.net
0el.biz
fortnitegamers.website
28687jr.com
contentandconverting.com
069superbetin.com
kyono-butsuryu.com
lewandosli.online
8herzelstreet.com
doofsmile.com
kreditnekarticehr.com
usalandia.com
mysmartoffice.tech
bens-coaching.com
catlyshop.com
ywdxpx.biz
gimnasiosyparques.com
socalfishfarm.com
uedfamily.com
gigacode.club
realestateplacercounty.com
bodychile.com
wolfbliss.com
lewisstaffyhome.com
bellsha.com
deservesloprr.xyz
nebilotakogo.space
ccstudenthouses.com
visitrovigo.com
benjamincavallo.club
algoritmos.online
incisuitotelnazilli.com
lojahado.com
perevents.com
fkjdkjreiofkkldskldfklefd.info
oprint.one
mmfaccao.com
webbyteanalysis.online
droidatlas.com
companyintel.direct
lckeqc.com
cryptodaita.com
unionplusgiveaway.com
williejfrinkcollegeprep.com
algospace.xyz
lockpickinghub.com
beeyondeasy.com
royalbee2021.com
serviciowebconfiables.com
hongxu88.com
oqnr.top
kindsies.com
polloycarnesdelivery.com
junkremovallawrencevillega.com
quantumcarbon.info
veiolution.com
tonkatu-pig.com
bogorvacation.com
woodyapperal.com
mine4mind.com
Signatures
-
Xloader family
-
Xloader payload 1 IoCs
resource yara_rule behavioral2/memory/5068-12-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4268 set thread context of 5068 4268 3d2aeedacfc41b9882494188059bcf1c81160920d4e83fc1f604d0381bca9ea7.exe 91 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d2aeedacfc41b9882494188059bcf1c81160920d4e83fc1f604d0381bca9ea7.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5068 3d2aeedacfc41b9882494188059bcf1c81160920d4e83fc1f604d0381bca9ea7.exe 5068 3d2aeedacfc41b9882494188059bcf1c81160920d4e83fc1f604d0381bca9ea7.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4268 wrote to memory of 5068 4268 3d2aeedacfc41b9882494188059bcf1c81160920d4e83fc1f604d0381bca9ea7.exe 91 PID 4268 wrote to memory of 5068 4268 3d2aeedacfc41b9882494188059bcf1c81160920d4e83fc1f604d0381bca9ea7.exe 91 PID 4268 wrote to memory of 5068 4268 3d2aeedacfc41b9882494188059bcf1c81160920d4e83fc1f604d0381bca9ea7.exe 91 PID 4268 wrote to memory of 5068 4268 3d2aeedacfc41b9882494188059bcf1c81160920d4e83fc1f604d0381bca9ea7.exe 91 PID 4268 wrote to memory of 5068 4268 3d2aeedacfc41b9882494188059bcf1c81160920d4e83fc1f604d0381bca9ea7.exe 91 PID 4268 wrote to memory of 5068 4268 3d2aeedacfc41b9882494188059bcf1c81160920d4e83fc1f604d0381bca9ea7.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d2aeedacfc41b9882494188059bcf1c81160920d4e83fc1f604d0381bca9ea7.exe"C:\Users\Admin\AppData\Local\Temp\3d2aeedacfc41b9882494188059bcf1c81160920d4e83fc1f604d0381bca9ea7.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\3d2aeedacfc41b9882494188059bcf1c81160920d4e83fc1f604d0381bca9ea7.exe"C:\Users\Admin\AppData\Local\Temp\3d2aeedacfc41b9882494188059bcf1c81160920d4e83fc1f604d0381bca9ea7.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5068
-