Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
07-05-2021 16:07
Static task
static1
Behavioral task
behavioral1
Sample
987654OIUYFG.exe
Resource
win7v20210410
General
-
Target
987654OIUYFG.exe
-
Size
821KB
-
MD5
0e0d5f9088ea19c58c3763c0ada56396
-
SHA1
cfe4ae26328d511ac04c2a51aebdb82ee463c0d3
-
SHA256
7f0511e940e8caa44c759e4696bf6b6b7f1389a2290b25c5e3f491270c63daab
-
SHA512
cf4aea4bd30333fdfbf8dbfcd1ae9909f281f0e67b14d8d4d0c9ae4ac5d2579af968d1022169b238016b00448dd49c8de7b13b1f6824fecf56b15a08c4364e6b
Malware Config
Extracted
xloader
2.3
http://www.hysjs168.com/uv34/
lattakia-imbiss.com
helenafinaltouch.com
yogamays.com
habangli.com
embraceblm.com
freeurlsite.com
szxanpet.com
inspirationalsblog.com
calibratefirearms.net
chelseashalza.com
ihdeuruim.com
symbolofsafety.com
albanyhumanesociety.net
exclusiveoffer.bet
888yuntu.com
maraitime.com
caletaexperience.com
dreamlikeliving.com
wolvesmito.club
zbyunjin.com
senkrononline.com
thesugarbasket.com
organiccbgoil.com
amazoncor.xyz
dofus-tr.com
bhzconstrutora.com
onlinepaintandsips.com
sandybottomsflipflops.com
paobuyingxiong.com
wokeinteractive.com
furbabiesandflowers.com
hellojesse.com
ssssummit.com
vaiu-ks.com
akb48-loveantena.com
wagsorganics.com
import-union.com
sxrqsgs.icu
72loca.com
ssc018.com
jewelta.com
buildingdigitalmind.com
pantechinsulation.com
cobakoreksinjinx.com
mischurretes.com
contorig2.com
julesecurity.com
soccer-yokouchi.club
gofourd.com
holdimob.com
omorashi-mania.com
ytksw.com
gsf-fashon.com
bogolacke.com
odislewis.com
shenzhenmaojinchang.com
kimsfist.com
xsites-dev.xyz
buraktradingltd.com
muldentaxi.com
supergurlmarketing.com
areametalurgia.com
dejikatsu.com
pcbet999.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/996-125-0x000000000041CFC0-mapping.dmp xloader behavioral2/memory/996-124-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/3916-132-0x0000000000720000-0x0000000000748000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
987654OIUYFG.exeRegSvcs.execontrol.exedescription pid process target process PID 3008 set thread context of 996 3008 987654OIUYFG.exe RegSvcs.exe PID 996 set thread context of 3020 996 RegSvcs.exe Explorer.EXE PID 3916 set thread context of 3020 3916 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
RegSvcs.execontrol.exepid process 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 3916 control.exe 3916 control.exe 3916 control.exe 3916 control.exe 3916 control.exe 3916 control.exe 3916 control.exe 3916 control.exe 3916 control.exe 3916 control.exe 3916 control.exe 3916 control.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.execontrol.exepid process 996 RegSvcs.exe 996 RegSvcs.exe 996 RegSvcs.exe 3916 control.exe 3916 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.execontrol.exedescription pid process Token: SeDebugPrivilege 996 RegSvcs.exe Token: SeDebugPrivilege 3916 control.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
987654OIUYFG.exeExplorer.EXEcontrol.exedescription pid process target process PID 3008 wrote to memory of 996 3008 987654OIUYFG.exe RegSvcs.exe PID 3008 wrote to memory of 996 3008 987654OIUYFG.exe RegSvcs.exe PID 3008 wrote to memory of 996 3008 987654OIUYFG.exe RegSvcs.exe PID 3008 wrote to memory of 996 3008 987654OIUYFG.exe RegSvcs.exe PID 3008 wrote to memory of 996 3008 987654OIUYFG.exe RegSvcs.exe PID 3008 wrote to memory of 996 3008 987654OIUYFG.exe RegSvcs.exe PID 3020 wrote to memory of 3916 3020 Explorer.EXE control.exe PID 3020 wrote to memory of 3916 3020 Explorer.EXE control.exe PID 3020 wrote to memory of 3916 3020 Explorer.EXE control.exe PID 3916 wrote to memory of 2436 3916 control.exe cmd.exe PID 3916 wrote to memory of 2436 3916 control.exe cmd.exe PID 3916 wrote to memory of 2436 3916 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\987654OIUYFG.exe"C:\Users\Admin\AppData\Local\Temp\987654OIUYFG.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/996-125-0x000000000041CFC0-mapping.dmp
-
memory/996-128-0x0000000001880000-0x0000000001BA0000-memory.dmpFilesize
3.1MB
-
memory/996-129-0x00000000013F0000-0x0000000001400000-memory.dmpFilesize
64KB
-
memory/996-124-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2436-133-0x0000000000000000-mapping.dmp
-
memory/3008-120-0x0000000007D60000-0x0000000007D61000-memory.dmpFilesize
4KB
-
memory/3008-118-0x0000000007EB0000-0x0000000007EB1000-memory.dmpFilesize
4KB
-
memory/3008-122-0x0000000002F80000-0x0000000003019000-memory.dmpFilesize
612KB
-
memory/3008-123-0x0000000001610000-0x0000000001662000-memory.dmpFilesize
328KB
-
memory/3008-114-0x0000000000E50000-0x0000000000E51000-memory.dmpFilesize
4KB
-
memory/3008-119-0x0000000007C90000-0x000000000818E000-memory.dmpFilesize
5.0MB
-
memory/3008-116-0x0000000008190000-0x0000000008191000-memory.dmpFilesize
4KB
-
memory/3008-121-0x0000000008050000-0x000000000805E000-memory.dmpFilesize
56KB
-
memory/3008-117-0x0000000007D70000-0x0000000007D71000-memory.dmpFilesize
4KB
-
memory/3020-127-0x0000000004A30000-0x0000000004B9B000-memory.dmpFilesize
1.4MB
-
memory/3020-136-0x0000000004BA0000-0x0000000004CF9000-memory.dmpFilesize
1.3MB
-
memory/3916-130-0x0000000000000000-mapping.dmp
-
memory/3916-132-0x0000000000720000-0x0000000000748000-memory.dmpFilesize
160KB
-
memory/3916-131-0x0000000001080000-0x00000000010A0000-memory.dmpFilesize
128KB
-
memory/3916-134-0x00000000047E0000-0x0000000004B00000-memory.dmpFilesize
3.1MB
-
memory/3916-135-0x0000000004630000-0x00000000046BF000-memory.dmpFilesize
572KB