Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
07-05-2021 11:00
Static task
static1
Behavioral task
behavioral1
Sample
winlog.exe
Resource
win7v20210410
General
-
Target
winlog.exe
-
Size
696KB
-
MD5
5d2f26ac6b48725279d98aa87eff8506
-
SHA1
7ab3874eb9d316a503133367b12d3628e6dbe264
-
SHA256
06bed76c389db454d5b86a64bf7127a21c013b48d79b3b83511263c424f5cf65
-
SHA512
e81c607ee870bde0e5a84714f1634e19f6959d1f46a4d5ffea2baeba241712ca4f2e2bdf4f6c8794db7b35216ded5d52743b7faac75d3382dd58f88e24294e41
Malware Config
Extracted
xloader
2.3
http://www.zlzntiayc.icu/a6ru/
noseainsight.com
chateaudedigoine.com
tezhonda.com
lowergwyeneddmassage.com
convenienttext.com
quickbookaccountingpros.com
mashburneventcenter.com
marthabymsfashion.com
thearcadela.com
invisiblefingerprint.com
nikadoo.com
artsmartclinton.com
elitetouringinnovations.com
atualizarapp2020.com
nideke1.com
fyj-sh.com
rufflesales.com
algemixdelchef.com
appleoneplus.com
ryosuketanikawa.com
domainsforpharma.com
sxhsti.com
squeakyslimes.com
theccmsacademy.com
ketquavip1.net
hstchwritr.com
cabinettec.com
iiscoder.com
ozdjservices.com
needscheck.com
hammocksrecovery.com
thedaiquiriexplosion.com
tantricgirlclothing.com
stealthpup.com
homehunters-eg.com
buffaloce.com
resilientquality.com
020view.com
cheapyetihats.com
allamericanqueens.com
massagerest.com
photogenic.homes
globalcheapflights.net
kuppers.info
redfiendpub.com
nrbadvogados.com
nighthawkmediagroup.com
gilsilva022pro.com
healthpossibilities.com
japlasmartshop.com
6927199.com
pizzanpickle.com
schnitzel.party
spkariyer.com
amsterdambrownies.com
laboratorioinfodigital.com
retailmedicaldepot.com
registeraccountants.amsterdam
khadeidralegendre.com
indialearninghub.com
xinjidf.com
thehawkproz.com
shpmtents14.com
kelaskaya.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1512-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1512-126-0x000000000041D0C0-mapping.dmp xloader behavioral2/memory/1644-133-0x00000000004A0000-0x00000000004C9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
winlog.exewinlog.exehelp.exedescription pid process target process PID 3876 set thread context of 1512 3876 winlog.exe winlog.exe PID 1512 set thread context of 3016 1512 winlog.exe Explorer.EXE PID 1644 set thread context of 3016 1644 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
winlog.exewinlog.exehelp.exepid process 3876 winlog.exe 3876 winlog.exe 1512 winlog.exe 1512 winlog.exe 1512 winlog.exe 1512 winlog.exe 1644 help.exe 1644 help.exe 1644 help.exe 1644 help.exe 1644 help.exe 1644 help.exe 1644 help.exe 1644 help.exe 1644 help.exe 1644 help.exe 1644 help.exe 1644 help.exe 1644 help.exe 1644 help.exe 1644 help.exe 1644 help.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
winlog.exehelp.exepid process 1512 winlog.exe 1512 winlog.exe 1512 winlog.exe 1644 help.exe 1644 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
winlog.exewinlog.exehelp.exedescription pid process Token: SeDebugPrivilege 3876 winlog.exe Token: SeDebugPrivilege 1512 winlog.exe Token: SeDebugPrivilege 1644 help.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
winlog.exeExplorer.EXEhelp.exedescription pid process target process PID 3876 wrote to memory of 2212 3876 winlog.exe winlog.exe PID 3876 wrote to memory of 2212 3876 winlog.exe winlog.exe PID 3876 wrote to memory of 2212 3876 winlog.exe winlog.exe PID 3876 wrote to memory of 1512 3876 winlog.exe winlog.exe PID 3876 wrote to memory of 1512 3876 winlog.exe winlog.exe PID 3876 wrote to memory of 1512 3876 winlog.exe winlog.exe PID 3876 wrote to memory of 1512 3876 winlog.exe winlog.exe PID 3876 wrote to memory of 1512 3876 winlog.exe winlog.exe PID 3876 wrote to memory of 1512 3876 winlog.exe winlog.exe PID 3016 wrote to memory of 1644 3016 Explorer.EXE help.exe PID 3016 wrote to memory of 1644 3016 Explorer.EXE help.exe PID 3016 wrote to memory of 1644 3016 Explorer.EXE help.exe PID 1644 wrote to memory of 1236 1644 help.exe cmd.exe PID 1644 wrote to memory of 1236 1644 help.exe cmd.exe PID 1644 wrote to memory of 1236 1644 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\winlog.exe"C:\Users\Admin\AppData\Local\Temp\winlog.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\winlog.exe"C:\Users\Admin\AppData\Local\Temp\winlog.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\winlog.exe"C:\Users\Admin\AppData\Local\Temp\winlog.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\winlog.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1236-134-0x0000000000000000-mapping.dmp
-
memory/1512-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1512-128-0x0000000001A30000-0x0000000001D50000-memory.dmpFilesize
3.1MB
-
memory/1512-129-0x0000000001500000-0x000000000164A000-memory.dmpFilesize
1.3MB
-
memory/1512-126-0x000000000041D0C0-mapping.dmp
-
memory/1644-131-0x0000000000000000-mapping.dmp
-
memory/1644-136-0x0000000000E10000-0x0000000000E9F000-memory.dmpFilesize
572KB
-
memory/1644-135-0x0000000000AF0000-0x0000000000E10000-memory.dmpFilesize
3.1MB
-
memory/1644-133-0x00000000004A0000-0x00000000004C9000-memory.dmpFilesize
164KB
-
memory/1644-132-0x0000000001210000-0x0000000001217000-memory.dmpFilesize
28KB
-
memory/3016-130-0x0000000002930000-0x0000000002A0F000-memory.dmpFilesize
892KB
-
memory/3016-137-0x0000000005C60000-0x0000000005D64000-memory.dmpFilesize
1.0MB
-
memory/3876-117-0x0000000005230000-0x0000000005231000-memory.dmpFilesize
4KB
-
memory/3876-118-0x0000000004DD0000-0x0000000004DD1000-memory.dmpFilesize
4KB
-
memory/3876-121-0x0000000004D30000-0x000000000522E000-memory.dmpFilesize
5.0MB
-
memory/3876-114-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/3876-119-0x0000000004C50000-0x0000000004C51000-memory.dmpFilesize
4KB
-
memory/3876-120-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/3876-116-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/3876-124-0x00000000058A0000-0x00000000058D0000-memory.dmpFilesize
192KB
-
memory/3876-123-0x0000000000C40000-0x0000000000CB7000-memory.dmpFilesize
476KB
-
memory/3876-122-0x0000000004FA0000-0x0000000004FAE000-memory.dmpFilesize
56KB