Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
04-03-2021 14:16
Static task
static1
Behavioral task
behavioral1
Sample
NEW PURCHASE030421.exe
Resource
win7v20201028
General
-
Target
NEW PURCHASE030421.exe
-
Size
763KB
-
MD5
22a713d3238d80c59e754d58dbbc258b
-
SHA1
eac5f6f22c3aa5e1616c683925db9b568a9b0813
-
SHA256
58415bcbd41e70c3f6d45f7b4fa75cf79c1f86f790decfec1dfe52be21f4c994
-
SHA512
f03cc374c3bfa1de62de177e99e6e5669664f1f70ded3b29972faa40d682461419b83655aba05b611efc0b3b1042face10a91f32fc2759a05d827138ab4c103d
Malware Config
Extracted
xloader
http://www.besthardinquiryremoval.services/noi6/
daliglobalservice.com
thenationschristianchurch.com
aliqy.com
grace-saunders.com
endlessretirement.com
stanleycupticket.com
dltgame.club
healthqnahindi.com
salniyrk.icu
laurasbaked.com
vintagechinese.com
agrocomposites.com
aimedsports.com
vegeatsdirect.com
goh-pbl.com
fairview.global
affiliateprogramscenter.com
blogizarshop.com
loorzon.com
curtex.info
magasinerquebec.com
nc0002.com
ecosysweb.com
engagesps.com
viewdriverch.com
zoonsf.online
bdaface.com
jerukstar.com
shopownage.com
rameshwarrajshastri.com
giftdeliveryinonehour.com
beijingpussy.com
fresh6milmerch.com
oldendo.com
untetherednews.com
meti-core.com
tergas.xyz
waltersellshouses.com
pinjamdanaja.com
theearthtrees.com
realestatebrokernc.com
automationaccepture.com
reflectsounds.net
calculatorformortgage.com
verify-check-code.com
flowerquick.xyz
sabaifunpark.com
tridentcnc.store
vegasfestivaltickets.com
sevenwonderscoffee.com
bestbiz.agency
nativeteacheronline.com
speecherouges.website
cn-chnet.com
betamaxfilms.com
divinationbyalexa.com
wow2beauty.com
jimshoneyforever.com
excoinbig-pro.com
artinmemory.com
amoreweddingsevents.com
103york.com
lemirtillo-restaurant.com
sensitiveadvantage.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/784-8-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/784-9-0x000000000041D160-mapping.dmp xloader behavioral1/memory/1432-17-0x00000000000F0000-0x0000000000119000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1056 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
NEW PURCHASE030421.exeNEW PURCHASE030421.exemsiexec.exedescription pid process target process PID 1152 set thread context of 784 1152 NEW PURCHASE030421.exe NEW PURCHASE030421.exe PID 784 set thread context of 1328 784 NEW PURCHASE030421.exe Explorer.EXE PID 1432 set thread context of 1328 1432 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
NEW PURCHASE030421.exemsiexec.exepid process 784 NEW PURCHASE030421.exe 784 NEW PURCHASE030421.exe 1432 msiexec.exe 1432 msiexec.exe 1432 msiexec.exe 1432 msiexec.exe 1432 msiexec.exe 1432 msiexec.exe 1432 msiexec.exe 1432 msiexec.exe 1432 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
NEW PURCHASE030421.exemsiexec.exepid process 784 NEW PURCHASE030421.exe 784 NEW PURCHASE030421.exe 784 NEW PURCHASE030421.exe 1432 msiexec.exe 1432 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
NEW PURCHASE030421.exemsiexec.exedescription pid process Token: SeDebugPrivilege 784 NEW PURCHASE030421.exe Token: SeDebugPrivilege 1432 msiexec.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
NEW PURCHASE030421.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1152 wrote to memory of 784 1152 NEW PURCHASE030421.exe NEW PURCHASE030421.exe PID 1152 wrote to memory of 784 1152 NEW PURCHASE030421.exe NEW PURCHASE030421.exe PID 1152 wrote to memory of 784 1152 NEW PURCHASE030421.exe NEW PURCHASE030421.exe PID 1152 wrote to memory of 784 1152 NEW PURCHASE030421.exe NEW PURCHASE030421.exe PID 1152 wrote to memory of 784 1152 NEW PURCHASE030421.exe NEW PURCHASE030421.exe PID 1152 wrote to memory of 784 1152 NEW PURCHASE030421.exe NEW PURCHASE030421.exe PID 1152 wrote to memory of 784 1152 NEW PURCHASE030421.exe NEW PURCHASE030421.exe PID 1328 wrote to memory of 1432 1328 Explorer.EXE msiexec.exe PID 1328 wrote to memory of 1432 1328 Explorer.EXE msiexec.exe PID 1328 wrote to memory of 1432 1328 Explorer.EXE msiexec.exe PID 1328 wrote to memory of 1432 1328 Explorer.EXE msiexec.exe PID 1328 wrote to memory of 1432 1328 Explorer.EXE msiexec.exe PID 1328 wrote to memory of 1432 1328 Explorer.EXE msiexec.exe PID 1328 wrote to memory of 1432 1328 Explorer.EXE msiexec.exe PID 1432 wrote to memory of 1056 1432 msiexec.exe cmd.exe PID 1432 wrote to memory of 1056 1432 msiexec.exe cmd.exe PID 1432 wrote to memory of 1056 1432 msiexec.exe cmd.exe PID 1432 wrote to memory of 1056 1432 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE030421.exe"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE030421.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE030421.exe"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE030421.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE030421.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/784-8-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/784-12-0x0000000000260000-0x0000000000270000-memory.dmpFilesize
64KB
-
memory/784-11-0x0000000000A10000-0x0000000000D13000-memory.dmpFilesize
3.0MB
-
memory/784-9-0x000000000041D160-mapping.dmp
-
memory/1056-19-0x0000000000000000-mapping.dmp
-
memory/1152-7-0x0000000004C40000-0x0000000004C8E000-memory.dmpFilesize
312KB
-
memory/1152-2-0x0000000074360000-0x0000000074A4E000-memory.dmpFilesize
6.9MB
-
memory/1152-6-0x0000000000870000-0x0000000000871000-memory.dmpFilesize
4KB
-
memory/1152-5-0x00000000004C0000-0x00000000004C7000-memory.dmpFilesize
28KB
-
memory/1152-3-0x0000000000940000-0x0000000000941000-memory.dmpFilesize
4KB
-
memory/1328-13-0x0000000006420000-0x000000000654B000-memory.dmpFilesize
1.2MB
-
memory/1432-14-0x0000000000000000-mapping.dmp
-
memory/1432-15-0x00000000760C1000-0x00000000760C3000-memory.dmpFilesize
8KB
-
memory/1432-16-0x0000000000280000-0x0000000000294000-memory.dmpFilesize
80KB
-
memory/1432-17-0x00000000000F0000-0x0000000000119000-memory.dmpFilesize
164KB
-
memory/1432-18-0x0000000002290000-0x0000000002593000-memory.dmpFilesize
3.0MB
-
memory/1432-20-0x0000000001FC0000-0x000000000204F000-memory.dmpFilesize
572KB