Analysis
- max time kernel
150s - max time network
150s - platform
windows10_x64 - resource
win10v20201028 - submitted
08/04/2021, 10:39
Static task
static1
Behavioral task
behavioral1
Sample
RCS76393.exe
Resource
win7v20201028
windows7_x64
General
- Target RCS76393.exe
- Size 377KB
- Sample210408-1p81lph3ps
- SHA256 5d1870672eff4e2ec6d699d654d5268051f7a56f8ca991fefa538eeef380a89c
- MD5 1ab1c3129fa0764ea0702da70f3ef569
- SHA1 ee8cd1946b58390f4599056df1472d01cf85a543
- SHA512 58bb904dc8d4435e232936f2972037dbf8b214559d0156c5d5275fdc3547a25e7ce92910459cd7f5c737641df74078e7060f0825df79b99203c2fb5033a0501c
- MD5 SHA1 SHA512
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.batiktintaemas.com/goei/
-
bet365o2.com
-
gulf-landlord.info
-
foodsystemsjusticeproject.com
-
ronwongart.com
-
fwgkdhg.icu
-
armanrugservice.com
-
mapadequito.com
-
vbkulkarni.com
-
ltsbinge.com
-
creativem2.com
-
mindflexlab.com
-
ushealthvisa.com
-
247carkeyslondon.com
-
addthat.xyz
-
zanzan8.com
-
legendsalliance.net
-
shopflyonline.com
-
csgo-roll.net
-
reutbergcapital.com
-
mediaworkhouse.com
-
office-tourism-tirana.com
-
evecrude.xyz
-
sportwillwin.com
-
cluskmusk.com
-
her2mymeme.com
-
rsw3313.com
-
digitalmarketingmoves.com
-
seaworldminecraft.com
-
onlinecollegetherapy.com
-
ourmonaca.com
-
generalflix.com
-
limonproduce.com
-
casalomasymphonyorchestra.com
-
karyapertama.com
-
massaponaxhighschool.com
-
covidtracksb.com
-
breathharbour.net
-
italianrealestateagents.com
-
xn--ga-c9a.com
-
libreo.club
-
leverhump.store
-
kevinrsamuels.network
-
pimpmyrecipe.com
-
win-back.online
-
kelasipo.com
-
caross-china.com
-
ly-iot.com
-
nolimitsynthetics.net
-
epicfriend.club
-
19come.com
-
lcjzjt.com
-
lxpvccard.com
-
distributorfocuson.com
-
looneytunesrun.com
-
mariebiernacki.com
-
maquinaclub.com
-
randalldavisauthor.com
-
niggeruprising.com
-
theexpatweightcoach.com
-
mex33.info
-
imbravura.com
-
baldosasanjose.com
-
akindousa.com
-
ourmunera.net
Signatures
- Xloader Payload 4 IoCs
resource yara_rule behavioral2/memory/992-114-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/992-115-0x000000000041D060-mapping.dmp xloader behavioral2/memory/1212-116-0x0000000005AE0000-0x0000000005B0A000-memory.dmp xloader behavioral2/memory/196-123-0x0000000002A20000-0x0000000002A49000-memory.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1212 set thread context of 992 1212 RCS76393.exe 76 PID 992 set thread context of 2396 992 RCS76393.exe 24 PID 196 set thread context of 2396 196 explorer.exe 24 - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 992 RCS76393.exe 992 RCS76393.exe 992 RCS76393.exe 992 RCS76393.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe 196 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2396 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 992 RCS76393.exe 992 RCS76393.exe 992 RCS76393.exe 196 explorer.exe 196 explorer.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 992 RCS76393.exe Token: SeDebugPrivilege 196 explorer.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2396 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1212 wrote to memory of 992 1212 RCS76393.exe 76 PID 1212 wrote to memory of 992 1212 RCS76393.exe 76 PID 1212 wrote to memory of 992 1212 RCS76393.exe 76 PID 1212 wrote to memory of 992 1212 RCS76393.exe 76 PID 1212 wrote to memory of 992 1212 RCS76393.exe 76 PID 1212 wrote to memory of 992 1212 RCS76393.exe 76 PID 2396 wrote to memory of 196 2396 Explorer.EXE 77 PID 2396 wrote to memory of 196 2396 Explorer.EXE 77 PID 2396 wrote to memory of 196 2396 Explorer.EXE 77 PID 196 wrote to memory of 2916 196 explorer.exe 81 PID 196 wrote to memory of 2916 196 explorer.exe 81 PID 196 wrote to memory of 2916 196 explorer.exe 81
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\RCS76393.exe"C:\Users\Admin\AppData\Local\Temp\RCS76393.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\RCS76393.exe"C:\Users\Admin\AppData\Local\Temp\RCS76393.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:992
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:196 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RCS76393.exe"3⤵PID:2916
-
-