Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
21-04-2021 17:52
Static task
static1
Behavioral task
behavioral1
Sample
xvhostb.exe
Resource
win7v20210410
General
-
Target
xvhostb.exe
-
Size
611KB
-
MD5
a1d6e3ac3ee1adbbc7a16e5f7d7cac1d
-
SHA1
c389f7fe73ba9c75d391c9f9c2bcff87c51556c7
-
SHA256
c076e25acd902f35a52bdb12240494e39df85412b09111e451afdc584487b5df
-
SHA512
d247593dcf889544745ff02599f8094811a83a159c9818c377b00ff39daa68be8125f799d23074b57e2ddfeb878b5d68615e3f258e646164aca98c19dba5807b
Malware Config
Extracted
xloader
2.3
http://www.allindiatrust.com/sbjq/
topbrandslook.xyz
kupilabs.com
cedrick.net
91mh.info
ajoph.net
finishtheverse.com
pondokquranaljariyah.com
happyhoopoe.com
lowcostfooddelivery.com
estudiosvacunacovid19-co.com
iestradanhhome.com
xn--caasymas-e3a.com
shopqls.com
wpnator.com
parentedagency.com
nundmshop.com
lodosmimarlik.com
ccidyy.xyz
bem-vestida.com
smartincomeafrica.com
luckydaysshop.com
spaceorbits.net
mindtattooed.com
pengruncapital.com
colesmxth.com
biyahetours.com
15211avis.com
marshylime.com
cinmax.xyz
marriedtwomusic.com
fakingslatino.com
slotspinbet.com
classicluxuryboats.com
missjenniferteaches.com
minimalismoweb.com
mlblandscaping.co.uk
gzotuo.com
coffeetaste0.com
ylty88.com
437bowlinggreen.com
hinetin.net
umkateknoloji.com
bnsubstock.com
ftxhxx.com
russellandcompanyrealestate.com
hamrocity.com
thenicolehernandez.com
afspinc.com
artlyusa.com
cryptocurrencydefi.com
betteryouwiththeoils.com
energetichealingsystem.com
lucaslh.com
undeadvengeance.com
count230.com
landerauto.com
sxqxga.com
assetsking.com
prosperedfreelancing.com
bee-yondimagination.com
androidwerks.com
securitymanagementcfo.com
iwouldbetonthat.com
appstore-verify-appleid.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/744-126-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/744-127-0x000000000041D060-mapping.dmp xloader behavioral2/memory/4044-137-0x0000000000C30000-0x0000000000C59000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
xvhostb.exexvhostb.exemsiexec.exedescription pid process target process PID 800 set thread context of 744 800 xvhostb.exe xvhostb.exe PID 744 set thread context of 3044 744 xvhostb.exe Explorer.EXE PID 4044 set thread context of 3044 4044 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
xvhostb.exexvhostb.exemsiexec.exepid process 800 xvhostb.exe 800 xvhostb.exe 800 xvhostb.exe 744 xvhostb.exe 744 xvhostb.exe 744 xvhostb.exe 744 xvhostb.exe 4044 msiexec.exe 4044 msiexec.exe 4044 msiexec.exe 4044 msiexec.exe 4044 msiexec.exe 4044 msiexec.exe 4044 msiexec.exe 4044 msiexec.exe 4044 msiexec.exe 4044 msiexec.exe 4044 msiexec.exe 4044 msiexec.exe 4044 msiexec.exe 4044 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
xvhostb.exemsiexec.exepid process 744 xvhostb.exe 744 xvhostb.exe 744 xvhostb.exe 4044 msiexec.exe 4044 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
xvhostb.exexvhostb.exemsiexec.exedescription pid process Token: SeDebugPrivilege 800 xvhostb.exe Token: SeDebugPrivilege 744 xvhostb.exe Token: SeDebugPrivilege 4044 msiexec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
xvhostb.exeExplorer.EXEmsiexec.exedescription pid process target process PID 800 wrote to memory of 744 800 xvhostb.exe xvhostb.exe PID 800 wrote to memory of 744 800 xvhostb.exe xvhostb.exe PID 800 wrote to memory of 744 800 xvhostb.exe xvhostb.exe PID 800 wrote to memory of 744 800 xvhostb.exe xvhostb.exe PID 800 wrote to memory of 744 800 xvhostb.exe xvhostb.exe PID 800 wrote to memory of 744 800 xvhostb.exe xvhostb.exe PID 3044 wrote to memory of 4044 3044 Explorer.EXE msiexec.exe PID 3044 wrote to memory of 4044 3044 Explorer.EXE msiexec.exe PID 3044 wrote to memory of 4044 3044 Explorer.EXE msiexec.exe PID 4044 wrote to memory of 1116 4044 msiexec.exe cmd.exe PID 4044 wrote to memory of 1116 4044 msiexec.exe cmd.exe PID 4044 wrote to memory of 1116 4044 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xvhostb.exe"C:\Users\Admin\AppData\Local\Temp\xvhostb.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xvhostb.exe"C:\Users\Admin\AppData\Local\Temp\xvhostb.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\xvhostb.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/744-126-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/744-131-0x0000000001820000-0x0000000001831000-memory.dmpFilesize
68KB
-
memory/744-129-0x0000000001500000-0x0000000001820000-memory.dmpFilesize
3.1MB
-
memory/744-127-0x000000000041D060-mapping.dmp
-
memory/800-125-0x0000000000F40000-0x0000000000F7D000-memory.dmpFilesize
244KB
-
memory/800-117-0x00000000055A0000-0x00000000055A1000-memory.dmpFilesize
4KB
-
memory/800-122-0x000000007F640000-0x000000007F641000-memory.dmpFilesize
4KB
-
memory/800-121-0x0000000004F60000-0x0000000004FFC000-memory.dmpFilesize
624KB
-
memory/800-123-0x0000000005580000-0x0000000005589000-memory.dmpFilesize
36KB
-
memory/800-124-0x0000000005E80000-0x0000000005F02000-memory.dmpFilesize
520KB
-
memory/800-114-0x00000000006F0000-0x00000000006F1000-memory.dmpFilesize
4KB
-
memory/800-119-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/800-118-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/800-120-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/800-116-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/1116-135-0x0000000000000000-mapping.dmp
-
memory/3044-130-0x00000000066B0000-0x000000000684D000-memory.dmpFilesize
1.6MB
-
memory/3044-140-0x0000000006850000-0x00000000069AD000-memory.dmpFilesize
1.4MB
-
memory/4044-132-0x0000000000000000-mapping.dmp
-
memory/4044-137-0x0000000000C30000-0x0000000000C59000-memory.dmpFilesize
164KB
-
memory/4044-136-0x0000000001300000-0x0000000001312000-memory.dmpFilesize
72KB
-
memory/4044-138-0x0000000004AD0000-0x0000000004DF0000-memory.dmpFilesize
3.1MB
-
memory/4044-139-0x00000000049C0000-0x0000000004A50000-memory.dmpFilesize
576KB