Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
03-05-2021 19:47
Static task
static1
Behavioral task
behavioral1
Sample
0876543123.exe
Resource
win7v20210410
General
-
Target
0876543123.exe
-
Size
877KB
-
MD5
24c3633ca4bad6a19c4e8bf886ffb107
-
SHA1
d560ecb453a735e927fbb7d40f7e3a3500bc1f44
-
SHA256
095c9312eb908db14dd9d8185b36172f2b3ab24452af632abbffec2a4a61332a
-
SHA512
b666d26236c76edd479ebbce6be0ae011e76ea4856b2db6cac5c91f56c044b868ff5cdca8c30c16dbb4519ce40e04a003a2f1c23de9ce3e27f4bd1b2dfc794c4
Malware Config
Extracted
xloader
2.3
http://www.hysjs168.com/uv34/
lattakia-imbiss.com
helenafinaltouch.com
yogamays.com
habangli.com
embraceblm.com
freeurlsite.com
szxanpet.com
inspirationalsblog.com
calibratefirearms.net
chelseashalza.com
ihdeuruim.com
symbolofsafety.com
albanyhumanesociety.net
exclusiveoffer.bet
888yuntu.com
maraitime.com
caletaexperience.com
dreamlikeliving.com
wolvesmito.club
zbyunjin.com
senkrononline.com
thesugarbasket.com
organiccbgoil.com
amazoncor.xyz
dofus-tr.com
bhzconstrutora.com
onlinepaintandsips.com
sandybottomsflipflops.com
paobuyingxiong.com
wokeinteractive.com
furbabiesandflowers.com
hellojesse.com
ssssummit.com
vaiu-ks.com
akb48-loveantena.com
wagsorganics.com
import-union.com
sxrqsgs.icu
72loca.com
ssc018.com
jewelta.com
buildingdigitalmind.com
pantechinsulation.com
cobakoreksinjinx.com
mischurretes.com
contorig2.com
julesecurity.com
soccer-yokouchi.club
gofourd.com
holdimob.com
omorashi-mania.com
ytksw.com
gsf-fashon.com
bogolacke.com
odislewis.com
shenzhenmaojinchang.com
kimsfist.com
xsites-dev.xyz
buraktradingltd.com
muldentaxi.com
supergurlmarketing.com
areametalurgia.com
dejikatsu.com
pcbet999.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1520-66-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1520-67-0x000000000041CFC0-mapping.dmp xloader behavioral1/memory/328-77-0x0000000000090000-0x00000000000B8000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
0876543123.exeRegSvcs.exemsiexec.exedescription pid process target process PID 1688 set thread context of 1520 1688 0876543123.exe RegSvcs.exe PID 1520 set thread context of 1208 1520 RegSvcs.exe Explorer.EXE PID 1520 set thread context of 1208 1520 RegSvcs.exe Explorer.EXE PID 328 set thread context of 1208 328 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
0876543123.exeRegSvcs.exemsiexec.exepid process 1688 0876543123.exe 1520 RegSvcs.exe 1520 RegSvcs.exe 1520 RegSvcs.exe 328 msiexec.exe 328 msiexec.exe 328 msiexec.exe 328 msiexec.exe 328 msiexec.exe 328 msiexec.exe 328 msiexec.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.exemsiexec.exepid process 1520 RegSvcs.exe 1520 RegSvcs.exe 1520 RegSvcs.exe 1520 RegSvcs.exe 328 msiexec.exe 328 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
0876543123.exeRegSvcs.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1688 0876543123.exe Token: SeDebugPrivilege 1520 RegSvcs.exe Token: SeDebugPrivilege 328 msiexec.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
0876543123.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1688 wrote to memory of 1520 1688 0876543123.exe RegSvcs.exe PID 1688 wrote to memory of 1520 1688 0876543123.exe RegSvcs.exe PID 1688 wrote to memory of 1520 1688 0876543123.exe RegSvcs.exe PID 1688 wrote to memory of 1520 1688 0876543123.exe RegSvcs.exe PID 1688 wrote to memory of 1520 1688 0876543123.exe RegSvcs.exe PID 1688 wrote to memory of 1520 1688 0876543123.exe RegSvcs.exe PID 1688 wrote to memory of 1520 1688 0876543123.exe RegSvcs.exe PID 1688 wrote to memory of 1520 1688 0876543123.exe RegSvcs.exe PID 1688 wrote to memory of 1520 1688 0876543123.exe RegSvcs.exe PID 1688 wrote to memory of 1520 1688 0876543123.exe RegSvcs.exe PID 1208 wrote to memory of 328 1208 Explorer.EXE msiexec.exe PID 1208 wrote to memory of 328 1208 Explorer.EXE msiexec.exe PID 1208 wrote to memory of 328 1208 Explorer.EXE msiexec.exe PID 1208 wrote to memory of 328 1208 Explorer.EXE msiexec.exe PID 1208 wrote to memory of 328 1208 Explorer.EXE msiexec.exe PID 1208 wrote to memory of 328 1208 Explorer.EXE msiexec.exe PID 1208 wrote to memory of 328 1208 Explorer.EXE msiexec.exe PID 328 wrote to memory of 1144 328 msiexec.exe cmd.exe PID 328 wrote to memory of 1144 328 msiexec.exe cmd.exe PID 328 wrote to memory of 1144 328 msiexec.exe cmd.exe PID 328 wrote to memory of 1144 328 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\0876543123.exe"C:\Users\Admin\AppData\Local\Temp\0876543123.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1520 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:1144
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/328-80-0x0000000001EE0000-0x0000000001F6F000-memory.dmpFilesize
572KB
-
memory/328-79-0x0000000002240000-0x0000000002543000-memory.dmpFilesize
3.0MB
-
memory/328-77-0x0000000000090000-0x00000000000B8000-memory.dmpFilesize
160KB
-
memory/328-76-0x00000000007A0000-0x00000000007B4000-memory.dmpFilesize
80KB
-
memory/328-75-0x0000000075011000-0x0000000075013000-memory.dmpFilesize
8KB
-
memory/328-74-0x0000000000000000-mapping.dmp
-
memory/1144-78-0x0000000000000000-mapping.dmp
-
memory/1208-73-0x0000000003E60000-0x0000000003F1E000-memory.dmpFilesize
760KB
-
memory/1208-81-0x0000000004F00000-0x0000000004FFC000-memory.dmpFilesize
1008KB
-
memory/1208-71-0x0000000004B00000-0x0000000004C1F000-memory.dmpFilesize
1.1MB
-
memory/1520-66-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1520-72-0x0000000000270000-0x0000000000280000-memory.dmpFilesize
64KB
-
memory/1520-69-0x0000000000B40000-0x0000000000E43000-memory.dmpFilesize
3.0MB
-
memory/1520-70-0x0000000000130000-0x0000000000140000-memory.dmpFilesize
64KB
-
memory/1520-67-0x000000000041CFC0-mapping.dmp
-
memory/1688-60-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/1688-65-0x0000000004190000-0x00000000041F9000-memory.dmpFilesize
420KB
-
memory/1688-64-0x0000000005120000-0x00000000051D0000-memory.dmpFilesize
704KB
-
memory/1688-63-0x0000000002100000-0x0000000002101000-memory.dmpFilesize
4KB
-
memory/1688-62-0x0000000000410000-0x000000000041E000-memory.dmpFilesize
56KB