Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
04-03-2021 18:19
Behavioral task
behavioral1
Sample
48c9e4c8_extracted.exe
Resource
win7v20201028
General
-
Target
48c9e4c8_extracted.exe
-
Size
160KB
-
MD5
d1a9b9e29edfb6ddefa1fe00e9486f6e
-
SHA1
4f8484df9b6ef4b54fbd7ebd882e10a155bc87f2
-
SHA256
bc68f1c3e90d38b089534333bded35a4c736b1d18bce2b2fe151a46a53ca390d
-
SHA512
3e87c8b6cac73fc46387891bda1c58d5ba0d3bee26f8c66eecbe4af976c5b8bd9c6b5bc3898743ebd488bf930077d3f310ac606c6332e120914ebb454274c4a0
Malware Config
Extracted
xloader
http://www.wekrazy.com/ianv/
toysclass.com
baohiemthuduc.com
dronesracers.com
wallis-platform.com
waltermorgan.fitness
vsn-designs.com
cengjing.life
trackcatologueorders.com
newworkpay.com
brainywoodindia.com
myrtlebeachstripperstoyou.com
saori.cloud
10fastvpn.com
freemindsweden.com
phatsquares.com
pandemia.tienda
7560eads6.com
sabjidada.com
zhyingj.group
nailmanicurest.com
makkoho.net
biaobazhongxin.com
wwwyourcardoctor.com
careless-customers2.com
greghickmanrealestate.com
testdomain0606.site
cantstealmyvote.com
binismailhealthcare.com
impact-holdingsgroup.com
plastic-girl.com
itcomputershn.com
racevx.xyz
jiangsuruiyou.com
tuding1688.com
kimloaig7.net
kannanconsulting.com
reconnecttogod.com
solverstv.com
therecover.computer
iamalittlesomething.com
rottendemocrats.com
triplayover.com
classonlinepy.com
magapatriotsdeals.com
casafacilpe.com
umasolarsupply.com
getinfloww.com
thecleanlifellc.com
knownyork.com
practicewithpersia.com
hervirtuouslife.com
goldjewelrybuyersplano.com
belleharlo.com
bundatrima.online
localvahomes.com
petreltradingchambers.com
jueligh.com
awadata.com
craftedcompulsion.com
dresiara.com
natsu-blog.net
nonbartv.com
greezymobbent.com
opelakcesoria.online
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2000-8-0x00000000000E0000-0x0000000000108000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1704 cmd.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
48c9e4c8_extracted.exehelp.exedescription pid process target process PID 1088 set thread context of 1236 1088 48c9e4c8_extracted.exe Explorer.EXE PID 2000 set thread context of 1236 2000 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
48c9e4c8_extracted.exehelp.exepid process 1088 48c9e4c8_extracted.exe 1088 48c9e4c8_extracted.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe 2000 help.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
48c9e4c8_extracted.exehelp.exepid process 1088 48c9e4c8_extracted.exe 1088 48c9e4c8_extracted.exe 1088 48c9e4c8_extracted.exe 2000 help.exe 2000 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
48c9e4c8_extracted.exehelp.exedescription pid process Token: SeDebugPrivilege 1088 48c9e4c8_extracted.exe Token: SeDebugPrivilege 2000 help.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Explorer.EXEhelp.exedescription pid process target process PID 1236 wrote to memory of 2000 1236 Explorer.EXE help.exe PID 1236 wrote to memory of 2000 1236 Explorer.EXE help.exe PID 1236 wrote to memory of 2000 1236 Explorer.EXE help.exe PID 1236 wrote to memory of 2000 1236 Explorer.EXE help.exe PID 2000 wrote to memory of 1704 2000 help.exe cmd.exe PID 2000 wrote to memory of 1704 2000 help.exe cmd.exe PID 2000 wrote to memory of 1704 2000 help.exe cmd.exe PID 2000 wrote to memory of 1704 2000 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\48c9e4c8_extracted.exe"C:\Users\Admin\AppData\Local\Temp\48c9e4c8_extracted.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\48c9e4c8_extracted.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1088-2-0x00000000008E0000-0x0000000000BE3000-memory.dmpFilesize
3.0MB
-
memory/1088-3-0x0000000000120000-0x0000000000130000-memory.dmpFilesize
64KB
-
memory/1236-4-0x0000000003BD0000-0x0000000003CB1000-memory.dmpFilesize
900KB
-
memory/1236-11-0x0000000002E30000-0x0000000002EC8000-memory.dmpFilesize
608KB
-
memory/1360-13-0x000007FEF6400000-0x000007FEF667A000-memory.dmpFilesize
2.5MB
-
memory/1704-6-0x0000000000000000-mapping.dmp
-
memory/2000-5-0x0000000000000000-mapping.dmp
-
memory/2000-8-0x00000000000E0000-0x0000000000108000-memory.dmpFilesize
160KB
-
memory/2000-7-0x0000000000F00000-0x0000000000F06000-memory.dmpFilesize
24KB
-
memory/2000-9-0x0000000000710000-0x0000000000A13000-memory.dmpFilesize
3.0MB
-
memory/2000-10-0x0000000000580000-0x000000000060F000-memory.dmpFilesize
572KB
-
memory/2000-12-0x0000000075D61000-0x0000000075D63000-memory.dmpFilesize
8KB