Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
03-05-2021 20:02
Static task
static1
Behavioral task
behavioral1
Sample
0876543123.exe
Resource
win7v20210410
General
-
Target
0876543123.exe
-
Size
877KB
-
MD5
24c3633ca4bad6a19c4e8bf886ffb107
-
SHA1
d560ecb453a735e927fbb7d40f7e3a3500bc1f44
-
SHA256
095c9312eb908db14dd9d8185b36172f2b3ab24452af632abbffec2a4a61332a
-
SHA512
b666d26236c76edd479ebbce6be0ae011e76ea4856b2db6cac5c91f56c044b868ff5cdca8c30c16dbb4519ce40e04a003a2f1c23de9ce3e27f4bd1b2dfc794c4
Malware Config
Extracted
xloader
2.3
http://www.hysjs168.com/uv34/
lattakia-imbiss.com
helenafinaltouch.com
yogamays.com
habangli.com
embraceblm.com
freeurlsite.com
szxanpet.com
inspirationalsblog.com
calibratefirearms.net
chelseashalza.com
ihdeuruim.com
symbolofsafety.com
albanyhumanesociety.net
exclusiveoffer.bet
888yuntu.com
maraitime.com
caletaexperience.com
dreamlikeliving.com
wolvesmito.club
zbyunjin.com
senkrononline.com
thesugarbasket.com
organiccbgoil.com
amazoncor.xyz
dofus-tr.com
bhzconstrutora.com
onlinepaintandsips.com
sandybottomsflipflops.com
paobuyingxiong.com
wokeinteractive.com
furbabiesandflowers.com
hellojesse.com
ssssummit.com
vaiu-ks.com
akb48-loveantena.com
wagsorganics.com
import-union.com
sxrqsgs.icu
72loca.com
ssc018.com
jewelta.com
buildingdigitalmind.com
pantechinsulation.com
cobakoreksinjinx.com
mischurretes.com
contorig2.com
julesecurity.com
soccer-yokouchi.club
gofourd.com
holdimob.com
omorashi-mania.com
ytksw.com
gsf-fashon.com
bogolacke.com
odislewis.com
shenzhenmaojinchang.com
kimsfist.com
xsites-dev.xyz
buraktradingltd.com
muldentaxi.com
supergurlmarketing.com
areametalurgia.com
dejikatsu.com
pcbet999.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/396-124-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/396-125-0x000000000041CFC0-mapping.dmp xloader behavioral2/memory/1052-133-0x0000000000DC0000-0x0000000000DE8000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
0876543123.exeRegSvcs.exerundll32.exedescription pid process target process PID 4812 set thread context of 396 4812 0876543123.exe RegSvcs.exe PID 396 set thread context of 2900 396 RegSvcs.exe Explorer.EXE PID 1052 set thread context of 2900 1052 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
RegSvcs.exerundll32.exepid process 396 RegSvcs.exe 396 RegSvcs.exe 396 RegSvcs.exe 396 RegSvcs.exe 1052 rundll32.exe 1052 rundll32.exe 1052 rundll32.exe 1052 rundll32.exe 1052 rundll32.exe 1052 rundll32.exe 1052 rundll32.exe 1052 rundll32.exe 1052 rundll32.exe 1052 rundll32.exe 1052 rundll32.exe 1052 rundll32.exe 1052 rundll32.exe 1052 rundll32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exerundll32.exepid process 396 RegSvcs.exe 396 RegSvcs.exe 396 RegSvcs.exe 1052 rundll32.exe 1052 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exerundll32.exedescription pid process Token: SeDebugPrivilege 396 RegSvcs.exe Token: SeDebugPrivilege 1052 rundll32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
0876543123.exeExplorer.EXErundll32.exedescription pid process target process PID 4812 wrote to memory of 396 4812 0876543123.exe RegSvcs.exe PID 4812 wrote to memory of 396 4812 0876543123.exe RegSvcs.exe PID 4812 wrote to memory of 396 4812 0876543123.exe RegSvcs.exe PID 4812 wrote to memory of 396 4812 0876543123.exe RegSvcs.exe PID 4812 wrote to memory of 396 4812 0876543123.exe RegSvcs.exe PID 4812 wrote to memory of 396 4812 0876543123.exe RegSvcs.exe PID 2900 wrote to memory of 1052 2900 Explorer.EXE rundll32.exe PID 2900 wrote to memory of 1052 2900 Explorer.EXE rundll32.exe PID 2900 wrote to memory of 1052 2900 Explorer.EXE rundll32.exe PID 1052 wrote to memory of 1276 1052 rundll32.exe cmd.exe PID 1052 wrote to memory of 1276 1052 rundll32.exe cmd.exe PID 1052 wrote to memory of 1276 1052 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\0876543123.exe"C:\Users\Admin\AppData\Local\Temp\0876543123.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:396 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:1276
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/396-124-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/396-128-0x0000000000900000-0x0000000000A4A000-memory.dmpFilesize
1.3MB
-
memory/396-127-0x0000000000FE0000-0x0000000001300000-memory.dmpFilesize
3.1MB
-
memory/396-125-0x000000000041CFC0-mapping.dmp
-
memory/1052-132-0x0000000004FB0000-0x00000000052D0000-memory.dmpFilesize
3.1MB
-
memory/1052-130-0x0000000000000000-mapping.dmp
-
memory/1052-135-0x0000000004D10000-0x0000000004D9F000-memory.dmpFilesize
572KB
-
memory/1052-133-0x0000000000DC0000-0x0000000000DE8000-memory.dmpFilesize
160KB
-
memory/1052-131-0x0000000001000000-0x0000000001013000-memory.dmpFilesize
76KB
-
memory/1276-134-0x0000000000000000-mapping.dmp
-
memory/2900-129-0x0000000006420000-0x0000000006522000-memory.dmpFilesize
1.0MB
-
memory/2900-136-0x0000000006890000-0x000000000699A000-memory.dmpFilesize
1.0MB
-
memory/4812-117-0x0000000004B80000-0x0000000004B81000-memory.dmpFilesize
4KB
-
memory/4812-116-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/4812-120-0x0000000004B80000-0x000000000507E000-memory.dmpFilesize
5.0MB
-
memory/4812-118-0x0000000004C20000-0x0000000004C21000-memory.dmpFilesize
4KB
-
memory/4812-114-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/4812-119-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/4812-123-0x0000000000970000-0x00000000009D9000-memory.dmpFilesize
420KB
-
memory/4812-122-0x0000000000A00000-0x0000000000AB0000-memory.dmpFilesize
704KB
-
memory/4812-121-0x0000000004EA0000-0x0000000004EAE000-memory.dmpFilesize
56KB