Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
07-05-2021 16:07
Static task
static1
Behavioral task
behavioral1
Sample
987654OIUYFG.exe
Resource
win7v20210410
General
-
Target
987654OIUYFG.exe
-
Size
821KB
-
MD5
0e0d5f9088ea19c58c3763c0ada56396
-
SHA1
cfe4ae26328d511ac04c2a51aebdb82ee463c0d3
-
SHA256
7f0511e940e8caa44c759e4696bf6b6b7f1389a2290b25c5e3f491270c63daab
-
SHA512
cf4aea4bd30333fdfbf8dbfcd1ae9909f281f0e67b14d8d4d0c9ae4ac5d2579af968d1022169b238016b00448dd49c8de7b13b1f6824fecf56b15a08c4364e6b
Malware Config
Extracted
xloader
2.3
http://www.hysjs168.com/uv34/
lattakia-imbiss.com
helenafinaltouch.com
yogamays.com
habangli.com
embraceblm.com
freeurlsite.com
szxanpet.com
inspirationalsblog.com
calibratefirearms.net
chelseashalza.com
ihdeuruim.com
symbolofsafety.com
albanyhumanesociety.net
exclusiveoffer.bet
888yuntu.com
maraitime.com
caletaexperience.com
dreamlikeliving.com
wolvesmito.club
zbyunjin.com
senkrononline.com
thesugarbasket.com
organiccbgoil.com
amazoncor.xyz
dofus-tr.com
bhzconstrutora.com
onlinepaintandsips.com
sandybottomsflipflops.com
paobuyingxiong.com
wokeinteractive.com
furbabiesandflowers.com
hellojesse.com
ssssummit.com
vaiu-ks.com
akb48-loveantena.com
wagsorganics.com
import-union.com
sxrqsgs.icu
72loca.com
ssc018.com
jewelta.com
buildingdigitalmind.com
pantechinsulation.com
cobakoreksinjinx.com
mischurretes.com
contorig2.com
julesecurity.com
soccer-yokouchi.club
gofourd.com
holdimob.com
omorashi-mania.com
ytksw.com
gsf-fashon.com
bogolacke.com
odislewis.com
shenzhenmaojinchang.com
kimsfist.com
xsites-dev.xyz
buraktradingltd.com
muldentaxi.com
supergurlmarketing.com
areametalurgia.com
dejikatsu.com
pcbet999.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/432-67-0x000000000041CFC0-mapping.dmp xloader behavioral1/memory/432-66-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/920-75-0x00000000000D0000-0x00000000000F8000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
987654OIUYFG.exeRegSvcs.exemstsc.exedescription pid process target process PID 484 set thread context of 432 484 987654OIUYFG.exe RegSvcs.exe PID 432 set thread context of 1228 432 RegSvcs.exe Explorer.EXE PID 920 set thread context of 1228 920 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
RegSvcs.exemstsc.exepid process 432 RegSvcs.exe 432 RegSvcs.exe 920 mstsc.exe 920 mstsc.exe 920 mstsc.exe 920 mstsc.exe 920 mstsc.exe 920 mstsc.exe 920 mstsc.exe 920 mstsc.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exemstsc.exepid process 432 RegSvcs.exe 432 RegSvcs.exe 432 RegSvcs.exe 920 mstsc.exe 920 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exemstsc.exedescription pid process Token: SeDebugPrivilege 432 RegSvcs.exe Token: SeDebugPrivilege 920 mstsc.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
987654OIUYFG.exeExplorer.EXEmstsc.exedescription pid process target process PID 484 wrote to memory of 432 484 987654OIUYFG.exe RegSvcs.exe PID 484 wrote to memory of 432 484 987654OIUYFG.exe RegSvcs.exe PID 484 wrote to memory of 432 484 987654OIUYFG.exe RegSvcs.exe PID 484 wrote to memory of 432 484 987654OIUYFG.exe RegSvcs.exe PID 484 wrote to memory of 432 484 987654OIUYFG.exe RegSvcs.exe PID 484 wrote to memory of 432 484 987654OIUYFG.exe RegSvcs.exe PID 484 wrote to memory of 432 484 987654OIUYFG.exe RegSvcs.exe PID 484 wrote to memory of 432 484 987654OIUYFG.exe RegSvcs.exe PID 484 wrote to memory of 432 484 987654OIUYFG.exe RegSvcs.exe PID 484 wrote to memory of 432 484 987654OIUYFG.exe RegSvcs.exe PID 1228 wrote to memory of 920 1228 Explorer.EXE mstsc.exe PID 1228 wrote to memory of 920 1228 Explorer.EXE mstsc.exe PID 1228 wrote to memory of 920 1228 Explorer.EXE mstsc.exe PID 1228 wrote to memory of 920 1228 Explorer.EXE mstsc.exe PID 920 wrote to memory of 1140 920 mstsc.exe cmd.exe PID 920 wrote to memory of 1140 920 mstsc.exe cmd.exe PID 920 wrote to memory of 1140 920 mstsc.exe cmd.exe PID 920 wrote to memory of 1140 920 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\987654OIUYFG.exe"C:\Users\Admin\AppData\Local\Temp\987654OIUYFG.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/432-67-0x000000000041CFC0-mapping.dmp
-
memory/432-69-0x00000000008D0000-0x0000000000BD3000-memory.dmpFilesize
3.0MB
-
memory/432-70-0x0000000000100000-0x0000000000110000-memory.dmpFilesize
64KB
-
memory/432-66-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/484-65-0x00000000003E0000-0x0000000000432000-memory.dmpFilesize
328KB
-
memory/484-60-0x00000000010A0000-0x00000000010A1000-memory.dmpFilesize
4KB
-
memory/484-64-0x0000000007340000-0x00000000073D9000-memory.dmpFilesize
612KB
-
memory/484-63-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/484-62-0x00000000002D0000-0x00000000002DE000-memory.dmpFilesize
56KB
-
memory/920-73-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB
-
memory/920-72-0x0000000000000000-mapping.dmp
-
memory/920-74-0x0000000000410000-0x0000000000514000-memory.dmpFilesize
1.0MB
-
memory/920-75-0x00000000000D0000-0x00000000000F8000-memory.dmpFilesize
160KB
-
memory/920-77-0x00000000020B0000-0x00000000023B3000-memory.dmpFilesize
3.0MB
-
memory/920-78-0x0000000001E40000-0x0000000001ECF000-memory.dmpFilesize
572KB
-
memory/1140-76-0x0000000000000000-mapping.dmp
-
memory/1228-71-0x0000000004D00000-0x0000000004E8A000-memory.dmpFilesize
1.5MB
-
memory/1228-79-0x0000000004E90000-0x0000000004FDE000-memory.dmpFilesize
1.3MB