Analysis
-
max time kernel
94s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 20:42
Static task
static1
Behavioral task
behavioral1
Sample
daaefbbdddac6178d9d71fa1617d02705c4614c62cf981ed4534d33d60e0b5d6.exe
Resource
win7-20240903-en
General
-
Target
daaefbbdddac6178d9d71fa1617d02705c4614c62cf981ed4534d33d60e0b5d6.exe
-
Size
1.0MB
-
MD5
f58a8ef45fa7a4e7ffbf1dcb3eded720
-
SHA1
5e83a6c72104a3af601565fe7646eb83f3703585
-
SHA256
daaefbbdddac6178d9d71fa1617d02705c4614c62cf981ed4534d33d60e0b5d6
-
SHA512
a8dddc5fd4e8f0dcf2ac5c0a244b83b39b8c8a7477894df5d56e107bfc4efa29624e9f2ef394ec9054333a105ad01d53e5681502f08317d490080190c3c2e57e
-
SSDEEP
24576:YdBqCebfeuXVgOvrMb1krGy7FzpS+dI66+4ZTg+remT3:YdBqCafeEVprp7bq6OZTgI7
Malware Config
Extracted
xloader
2.5
w8rr
musimack.agency
stockdatai.com
obsidianfields.net
idahogunpros.com
leochun.com
tancal.cat
theselfishbrandofficial.com
undegenerateness.info
nhanoon.com
y566.top
arabfinasgodes.com
goldenmetaverse.com
adilafinpay.com
biblicalcaffeine365.com
golgesiz.net
hsshengri.com
bydarcy.net
sevichhar.com
sanjeshgaraneh.com
femdomfilms.biz
tothinkhealthy.com
constructionretails.com
grupokamus.xyz
crickofy.com
swooningheartsarts.com
powerfetish.com
lizi.tech
516624.net
hypercube-solutions.com
keepitng.com
goiad.com
promarkoperations.com
narasiforum.club
fruchtstube.com
protecchemicals.com
abbawaalema.quest
pending-aproval-item.com
plansforlwc.com
bethesdagardensthornton.net
chipre.net
space-time-solutions.com
wenwu360.com
zambia-info.com
iphone13pro.care
mysterypowerbike.com
howisyourday807.rest
7layerforensics.com
inanhtho.com
fanganba.com
aojinhl02.com
genesis-industrial.com
kozmoscollision.com
myfirstten.com
silveredgerentals.com
casapetrona.com
bertleys.com
tokiwo-kakeru-myouga.com
lelegianstudies.com
junkyardprivacy.com
ibs-australia.com
deso.host
sdglang.com
reallifehorrors.com
blond-hop.com
sextv18.com
Signatures
-
Xloader family
-
Xloader payload 1 IoCs
resource yara_rule behavioral2/memory/752-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4532 set thread context of 752 4532 daaefbbdddac6178d9d71fa1617d02705c4614c62cf981ed4534d33d60e0b5d6.exe 97 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language daaefbbdddac6178d9d71fa1617d02705c4614c62cf981ed4534d33d60e0b5d6.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 752 daaefbbdddac6178d9d71fa1617d02705c4614c62cf981ed4534d33d60e0b5d6.exe 752 daaefbbdddac6178d9d71fa1617d02705c4614c62cf981ed4534d33d60e0b5d6.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4532 wrote to memory of 752 4532 daaefbbdddac6178d9d71fa1617d02705c4614c62cf981ed4534d33d60e0b5d6.exe 97 PID 4532 wrote to memory of 752 4532 daaefbbdddac6178d9d71fa1617d02705c4614c62cf981ed4534d33d60e0b5d6.exe 97 PID 4532 wrote to memory of 752 4532 daaefbbdddac6178d9d71fa1617d02705c4614c62cf981ed4534d33d60e0b5d6.exe 97 PID 4532 wrote to memory of 752 4532 daaefbbdddac6178d9d71fa1617d02705c4614c62cf981ed4534d33d60e0b5d6.exe 97 PID 4532 wrote to memory of 752 4532 daaefbbdddac6178d9d71fa1617d02705c4614c62cf981ed4534d33d60e0b5d6.exe 97 PID 4532 wrote to memory of 752 4532 daaefbbdddac6178d9d71fa1617d02705c4614c62cf981ed4534d33d60e0b5d6.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\daaefbbdddac6178d9d71fa1617d02705c4614c62cf981ed4534d33d60e0b5d6.exe"C:\Users\Admin\AppData\Local\Temp\daaefbbdddac6178d9d71fa1617d02705c4614c62cf981ed4534d33d60e0b5d6.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\daaefbbdddac6178d9d71fa1617d02705c4614c62cf981ed4534d33d60e0b5d6.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:752
-