Analysis
-
max time kernel
301s -
max time network
310s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
06-09-2021 06:19
Static task
static1
Behavioral task
behavioral1
Sample
K.exe
Resource
win7-en
General
-
Target
K.exe
-
Size
723KB
-
MD5
de5ca69a7939c4a8ce6846463990aa7b
-
SHA1
358c3f58194ccc713f000e194024b817f6cb5320
-
SHA256
5bc9d0c8fd02f1c138178b1291378304a653717076f9e12ba4334609dcf7b11c
-
SHA512
827bb09597d0226e27e2740886993593d7565d1bb5d130ee46bd87c6663f1cb60ac369a3272675fad8c8d8789e3b6aaf822ef13bcdf89cf821830ce795a7f7c6
Malware Config
Extracted
xloader
2.3
t75f
http://www.vertexnailsblaine.com/t75f/
onegolfsydney.com
kaizensportscoaching.com
mliacbjv.icu
rinstech.net
midas-parts.com
istmenian.com
ibrahimpike.com
herbspaces.com
gentleman4higher.com
workabusiness.com
isabusive.website
222555dy.com
lwhyzhzb.xyz
gabrielabravoillanes.com
hearthomelife.com
buildswealth.com
printitaz.com
l-mventures.com
baincot3.com
nstaq-labs.com
wikendi.com
newyears21.com
citestaccnt1597730671.com
thecuriousincidentwes.com
alchembiopro.com
stardustanimations.com
ssgasiaw.com
sarajanesstudio.com
whitepointfineart.com
dlglawtx.com
doudiangroup.com
jackpod.team
abvoltprunus.bid
miimamablog.com
selfbuildwithmannok.com
thanhxuan99.online
germantos.com
waterdoor.net
wmscloud.net
services-24hras.com
maneadvisors.com
mosineetowing.com
blockdelightsmart.com
booyaka.design
brewery-run.com
dexteroushandmade.com
minhamochila.com
drawingwoo.com
thesalcombefurniturecompany.net
nashautoglass.com
beenationgear.com
cleanseforlifewellness.com
corecounselingcenter.info
naturalcreativesociety.com
sarcontraders.com
lickitbuddyrehab.com
theweekendrecap.com
cetiya-veluvana.com
w7asd.net
nyctophilia.net
asialion.net
goldentreegrp.com
jacobuspark.com
punchingforce.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/632-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/632-125-0x000000000041D110-mapping.dmp xloader behavioral2/memory/996-132-0x0000000000B50000-0x0000000000B79000-memory.dmp xloader -
Executes dropped EXE 1 IoCs
Processes:
regsvcrl4lm.exepid process 1680 regsvcrl4lm.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
netsh.exedescription ioc process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run netsh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\D2LX5HTXGVE = "C:\\Program Files (x86)\\C1be\\regsvcrl4lm.exe" netsh.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
K.exeRegSvcs.exenetsh.exedescription pid process target process PID 4796 set thread context of 632 4796 K.exe RegSvcs.exe PID 632 set thread context of 2900 632 RegSvcs.exe Explorer.EXE PID 996 set thread context of 2900 996 netsh.exe Explorer.EXE -
Drops file in Program Files directory 4 IoCs
Processes:
netsh.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\C1be\regsvcrl4lm.exe netsh.exe File opened for modification C:\Program Files (x86)\C1be Explorer.EXE File created C:\Program Files (x86)\C1be\regsvcrl4lm.exe Explorer.EXE File opened for modification C:\Program Files (x86)\C1be\regsvcrl4lm.exe Explorer.EXE -
Processes:
netsh.exedescription ioc process Key created \Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 netsh.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
K.exeRegSvcs.exenetsh.exepid process 4796 K.exe 4796 K.exe 632 RegSvcs.exe 632 RegSvcs.exe 632 RegSvcs.exe 632 RegSvcs.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2900 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
RegSvcs.exenetsh.exepid process 632 RegSvcs.exe 632 RegSvcs.exe 632 RegSvcs.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe 996 netsh.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
K.exeRegSvcs.exenetsh.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4796 K.exe Token: SeDebugPrivilege 632 RegSvcs.exe Token: SeDebugPrivilege 996 netsh.exe Token: SeShutdownPrivilege 2900 Explorer.EXE Token: SeCreatePagefilePrivilege 2900 Explorer.EXE Token: SeShutdownPrivilege 2900 Explorer.EXE Token: SeCreatePagefilePrivilege 2900 Explorer.EXE Token: SeShutdownPrivilege 2900 Explorer.EXE Token: SeCreatePagefilePrivilege 2900 Explorer.EXE Token: SeShutdownPrivilege 2900 Explorer.EXE Token: SeCreatePagefilePrivilege 2900 Explorer.EXE Token: SeShutdownPrivilege 2900 Explorer.EXE Token: SeCreatePagefilePrivilege 2900 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2900 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
K.exeExplorer.EXEnetsh.exedescription pid process target process PID 4796 wrote to memory of 632 4796 K.exe RegSvcs.exe PID 4796 wrote to memory of 632 4796 K.exe RegSvcs.exe PID 4796 wrote to memory of 632 4796 K.exe RegSvcs.exe PID 4796 wrote to memory of 632 4796 K.exe RegSvcs.exe PID 4796 wrote to memory of 632 4796 K.exe RegSvcs.exe PID 4796 wrote to memory of 632 4796 K.exe RegSvcs.exe PID 2900 wrote to memory of 996 2900 Explorer.EXE netsh.exe PID 2900 wrote to memory of 996 2900 Explorer.EXE netsh.exe PID 2900 wrote to memory of 996 2900 Explorer.EXE netsh.exe PID 996 wrote to memory of 1032 996 netsh.exe cmd.exe PID 996 wrote to memory of 1032 996 netsh.exe cmd.exe PID 996 wrote to memory of 1032 996 netsh.exe cmd.exe PID 996 wrote to memory of 1652 996 netsh.exe Firefox.exe PID 996 wrote to memory of 1652 996 netsh.exe Firefox.exe PID 2900 wrote to memory of 1680 2900 Explorer.EXE regsvcrl4lm.exe PID 2900 wrote to memory of 1680 2900 Explorer.EXE regsvcrl4lm.exe PID 2900 wrote to memory of 1680 2900 Explorer.EXE regsvcrl4lm.exe PID 996 wrote to memory of 1652 996 netsh.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\K.exe"C:\Users\Admin\AppData\Local\Temp\K.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\C1be\regsvcrl4lm.exe"C:\Program Files (x86)\C1be\regsvcrl4lm.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\C1be\regsvcrl4lm.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Program Files (x86)\C1be\regsvcrl4lm.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
memory/632-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/632-126-0x00000000013D0000-0x00000000016F0000-memory.dmpFilesize
3.1MB
-
memory/632-127-0x0000000000E00000-0x0000000000F4A000-memory.dmpFilesize
1.3MB
-
memory/632-125-0x000000000041D110-mapping.dmp
-
memory/996-129-0x0000000000000000-mapping.dmp
-
memory/996-134-0x0000000003290000-0x000000000331F000-memory.dmpFilesize
572KB
-
memory/996-133-0x00000000035D0000-0x00000000038F0000-memory.dmpFilesize
3.1MB
-
memory/996-132-0x0000000000B50000-0x0000000000B79000-memory.dmpFilesize
164KB
-
memory/996-131-0x00000000010F0000-0x000000000110E000-memory.dmpFilesize
120KB
-
memory/1032-130-0x0000000000000000-mapping.dmp
-
memory/1652-143-0x00007FF631500000-0x00007FF631593000-memory.dmpFilesize
588KB
-
memory/1652-144-0x000001C59D590000-0x000001C59D65E000-memory.dmpFilesize
824KB
-
memory/1652-142-0x0000000000000000-mapping.dmp
-
memory/1680-136-0x0000000000000000-mapping.dmp
-
memory/1680-139-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/1680-141-0x0000000000D90000-0x0000000000D91000-memory.dmpFilesize
4KB
-
memory/1680-140-0x0000000002750000-0x0000000002751000-memory.dmpFilesize
4KB
-
memory/2900-128-0x0000000006420000-0x000000000650A000-memory.dmpFilesize
936KB
-
memory/2900-135-0x0000000006510000-0x000000000661F000-memory.dmpFilesize
1.1MB
-
memory/4796-119-0x0000000007CD0000-0x0000000007CD1000-memory.dmpFilesize
4KB
-
memory/4796-122-0x0000000009960000-0x00000000099C0000-memory.dmpFilesize
384KB
-
memory/4796-116-0x0000000008140000-0x0000000008141000-memory.dmpFilesize
4KB
-
memory/4796-117-0x0000000007D20000-0x0000000007D21000-memory.dmpFilesize
4KB
-
memory/4796-114-0x0000000000F10000-0x0000000000F11000-memory.dmpFilesize
4KB
-
memory/4796-118-0x0000000007C40000-0x000000000813E000-memory.dmpFilesize
5.0MB
-
memory/4796-120-0x000000000A0A0000-0x000000000A0A1000-memory.dmpFilesize
4KB
-
memory/4796-121-0x0000000007F10000-0x0000000007F26000-memory.dmpFilesize
88KB
-
memory/4796-123-0x0000000001970000-0x000000000199A000-memory.dmpFilesize
168KB