Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
03-05-2021 19:47
Static task
static1
Behavioral task
behavioral1
Sample
0876543123.exe
Resource
win7v20210410
General
-
Target
0876543123.exe
-
Size
877KB
-
MD5
24c3633ca4bad6a19c4e8bf886ffb107
-
SHA1
d560ecb453a735e927fbb7d40f7e3a3500bc1f44
-
SHA256
095c9312eb908db14dd9d8185b36172f2b3ab24452af632abbffec2a4a61332a
-
SHA512
b666d26236c76edd479ebbce6be0ae011e76ea4856b2db6cac5c91f56c044b868ff5cdca8c30c16dbb4519ce40e04a003a2f1c23de9ce3e27f4bd1b2dfc794c4
Malware Config
Extracted
xloader
2.3
http://www.hysjs168.com/uv34/
lattakia-imbiss.com
helenafinaltouch.com
yogamays.com
habangli.com
embraceblm.com
freeurlsite.com
szxanpet.com
inspirationalsblog.com
calibratefirearms.net
chelseashalza.com
ihdeuruim.com
symbolofsafety.com
albanyhumanesociety.net
exclusiveoffer.bet
888yuntu.com
maraitime.com
caletaexperience.com
dreamlikeliving.com
wolvesmito.club
zbyunjin.com
senkrononline.com
thesugarbasket.com
organiccbgoil.com
amazoncor.xyz
dofus-tr.com
bhzconstrutora.com
onlinepaintandsips.com
sandybottomsflipflops.com
paobuyingxiong.com
wokeinteractive.com
furbabiesandflowers.com
hellojesse.com
ssssummit.com
vaiu-ks.com
akb48-loveantena.com
wagsorganics.com
import-union.com
sxrqsgs.icu
72loca.com
ssc018.com
jewelta.com
buildingdigitalmind.com
pantechinsulation.com
cobakoreksinjinx.com
mischurretes.com
contorig2.com
julesecurity.com
soccer-yokouchi.club
gofourd.com
holdimob.com
omorashi-mania.com
ytksw.com
gsf-fashon.com
bogolacke.com
odislewis.com
shenzhenmaojinchang.com
kimsfist.com
xsites-dev.xyz
buraktradingltd.com
muldentaxi.com
supergurlmarketing.com
areametalurgia.com
dejikatsu.com
pcbet999.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1652-65-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1652-66-0x000000000041CFC0-mapping.dmp xloader behavioral1/memory/1632-73-0x00000000000C0000-0x00000000000E8000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
0876543123.exeRegSvcs.exechkdsk.exedescription pid process target process PID 1888 set thread context of 1652 1888 0876543123.exe RegSvcs.exe PID 1652 set thread context of 1260 1652 RegSvcs.exe Explorer.EXE PID 1632 set thread context of 1260 1632 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
0876543123.exeRegSvcs.exechkdsk.exepid process 1888 0876543123.exe 1652 RegSvcs.exe 1652 RegSvcs.exe 1632 chkdsk.exe 1632 chkdsk.exe 1632 chkdsk.exe 1632 chkdsk.exe 1632 chkdsk.exe 1632 chkdsk.exe 1632 chkdsk.exe 1632 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exechkdsk.exepid process 1652 RegSvcs.exe 1652 RegSvcs.exe 1652 RegSvcs.exe 1632 chkdsk.exe 1632 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
0876543123.exeRegSvcs.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1888 0876543123.exe Token: SeDebugPrivilege 1652 RegSvcs.exe Token: SeDebugPrivilege 1632 chkdsk.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
0876543123.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1888 wrote to memory of 1652 1888 0876543123.exe RegSvcs.exe PID 1888 wrote to memory of 1652 1888 0876543123.exe RegSvcs.exe PID 1888 wrote to memory of 1652 1888 0876543123.exe RegSvcs.exe PID 1888 wrote to memory of 1652 1888 0876543123.exe RegSvcs.exe PID 1888 wrote to memory of 1652 1888 0876543123.exe RegSvcs.exe PID 1888 wrote to memory of 1652 1888 0876543123.exe RegSvcs.exe PID 1888 wrote to memory of 1652 1888 0876543123.exe RegSvcs.exe PID 1888 wrote to memory of 1652 1888 0876543123.exe RegSvcs.exe PID 1888 wrote to memory of 1652 1888 0876543123.exe RegSvcs.exe PID 1888 wrote to memory of 1652 1888 0876543123.exe RegSvcs.exe PID 1260 wrote to memory of 1632 1260 Explorer.EXE chkdsk.exe PID 1260 wrote to memory of 1632 1260 Explorer.EXE chkdsk.exe PID 1260 wrote to memory of 1632 1260 Explorer.EXE chkdsk.exe PID 1260 wrote to memory of 1632 1260 Explorer.EXE chkdsk.exe PID 1632 wrote to memory of 732 1632 chkdsk.exe cmd.exe PID 1632 wrote to memory of 732 1632 chkdsk.exe cmd.exe PID 1632 wrote to memory of 732 1632 chkdsk.exe cmd.exe PID 1632 wrote to memory of 732 1632 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0876543123.exe"C:\Users\Admin\AppData\Local\Temp\0876543123.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/732-74-0x0000000000000000-mapping.dmp
-
memory/1260-70-0x00000000043F0000-0x00000000044B8000-memory.dmpFilesize
800KB
-
memory/1260-77-0x0000000004C20000-0x0000000004D62000-memory.dmpFilesize
1.3MB
-
memory/1632-76-0x00000000004C0000-0x000000000054F000-memory.dmpFilesize
572KB
-
memory/1632-75-0x0000000002170000-0x0000000002473000-memory.dmpFilesize
3.0MB
-
memory/1632-73-0x00000000000C0000-0x00000000000E8000-memory.dmpFilesize
160KB
-
memory/1632-72-0x00000000001B0000-0x00000000001B7000-memory.dmpFilesize
28KB
-
memory/1632-71-0x0000000000000000-mapping.dmp
-
memory/1652-69-0x0000000000100000-0x0000000000110000-memory.dmpFilesize
64KB
-
memory/1652-68-0x0000000000850000-0x0000000000B53000-memory.dmpFilesize
3.0MB
-
memory/1652-66-0x000000000041CFC0-mapping.dmp
-
memory/1652-65-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1888-59-0x0000000001180000-0x0000000001181000-memory.dmpFilesize
4KB
-
memory/1888-64-0x0000000004BB0000-0x0000000004C19000-memory.dmpFilesize
420KB
-
memory/1888-63-0x0000000005150000-0x0000000005200000-memory.dmpFilesize
704KB
-
memory/1888-62-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/1888-61-0x0000000000920000-0x000000000092E000-memory.dmpFilesize
56KB