Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en -
submitted
09-09-2021 23:52
Static task
static1
Behavioral task
behavioral1
Sample
B7hG4D8Jqvkw77U.exe
Resource
win7v20210408
General
-
Target
B7hG4D8Jqvkw77U.exe
-
Size
701KB
-
MD5
59ddaf036f92887a34441505f84d8cc8
-
SHA1
85745689e2f889b94b37379393a97a7a87dfec8b
-
SHA256
34f75f8458b1f58bdb1e8ff1a46270f98c6d246d213413cd0c4a7708e15e82c9
-
SHA512
336d392772f6d65f203f246c462673c92a293b91f4afc226c9613a80444004f69ef18572854e5755b22602efebfe6a0ad167a12a97ba00922a0fc8aaa3d7b0e5
Malware Config
Extracted
xloader
2.3
t75f
http://www.vertexnailsblaine.com/t75f/
onegolfsydney.com
kaizensportscoaching.com
mliacbjv.icu
rinstech.net
midas-parts.com
istmenian.com
ibrahimpike.com
herbspaces.com
gentleman4higher.com
workabusiness.com
isabusive.website
222555dy.com
lwhyzhzb.xyz
gabrielabravoillanes.com
hearthomelife.com
buildswealth.com
printitaz.com
l-mventures.com
baincot3.com
nstaq-labs.com
wikendi.com
newyears21.com
citestaccnt1597730671.com
thecuriousincidentwes.com
alchembiopro.com
stardustanimations.com
ssgasiaw.com
sarajanesstudio.com
whitepointfineart.com
dlglawtx.com
doudiangroup.com
jackpod.team
abvoltprunus.bid
miimamablog.com
selfbuildwithmannok.com
thanhxuan99.online
germantos.com
waterdoor.net
wmscloud.net
services-24hras.com
maneadvisors.com
mosineetowing.com
blockdelightsmart.com
booyaka.design
brewery-run.com
dexteroushandmade.com
minhamochila.com
drawingwoo.com
thesalcombefurniturecompany.net
nashautoglass.com
beenationgear.com
cleanseforlifewellness.com
corecounselingcenter.info
naturalcreativesociety.com
sarcontraders.com
lickitbuddyrehab.com
theweekendrecap.com
cetiya-veluvana.com
w7asd.net
nyctophilia.net
asialion.net
goldentreegrp.com
jacobuspark.com
punchingforce.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3824-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3824-126-0x000000000041D110-mapping.dmp xloader behavioral2/memory/1684-132-0x00000000030C0000-0x00000000030E9000-memory.dmp xloader behavioral2/memory/1684-134-0x00000000030F0000-0x000000000323A000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
B7hG4D8Jqvkw77U.exeRegSvcs.exesvchost.exedescription pid process target process PID 3952 set thread context of 3824 3952 B7hG4D8Jqvkw77U.exe RegSvcs.exe PID 3824 set thread context of 3008 3824 RegSvcs.exe Explorer.EXE PID 1684 set thread context of 3008 1684 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 52 IoCs
Processes:
B7hG4D8Jqvkw77U.exeRegSvcs.exesvchost.exepid process 3952 B7hG4D8Jqvkw77U.exe 3952 B7hG4D8Jqvkw77U.exe 3952 B7hG4D8Jqvkw77U.exe 3952 B7hG4D8Jqvkw77U.exe 3952 B7hG4D8Jqvkw77U.exe 3952 B7hG4D8Jqvkw77U.exe 3952 B7hG4D8Jqvkw77U.exe 3952 B7hG4D8Jqvkw77U.exe 3824 RegSvcs.exe 3824 RegSvcs.exe 3824 RegSvcs.exe 3824 RegSvcs.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3008 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exesvchost.exepid process 3824 RegSvcs.exe 3824 RegSvcs.exe 3824 RegSvcs.exe 1684 svchost.exe 1684 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
B7hG4D8Jqvkw77U.exeRegSvcs.exesvchost.exedescription pid process Token: SeDebugPrivilege 3952 B7hG4D8Jqvkw77U.exe Token: SeDebugPrivilege 3824 RegSvcs.exe Token: SeDebugPrivilege 1684 svchost.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3008 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
B7hG4D8Jqvkw77U.exeExplorer.EXEsvchost.exedescription pid process target process PID 3952 wrote to memory of 752 3952 B7hG4D8Jqvkw77U.exe RegSvcs.exe PID 3952 wrote to memory of 752 3952 B7hG4D8Jqvkw77U.exe RegSvcs.exe PID 3952 wrote to memory of 752 3952 B7hG4D8Jqvkw77U.exe RegSvcs.exe PID 3952 wrote to memory of 3820 3952 B7hG4D8Jqvkw77U.exe RegSvcs.exe PID 3952 wrote to memory of 3820 3952 B7hG4D8Jqvkw77U.exe RegSvcs.exe PID 3952 wrote to memory of 3820 3952 B7hG4D8Jqvkw77U.exe RegSvcs.exe PID 3952 wrote to memory of 3832 3952 B7hG4D8Jqvkw77U.exe RegSvcs.exe PID 3952 wrote to memory of 3832 3952 B7hG4D8Jqvkw77U.exe RegSvcs.exe PID 3952 wrote to memory of 3832 3952 B7hG4D8Jqvkw77U.exe RegSvcs.exe PID 3952 wrote to memory of 3824 3952 B7hG4D8Jqvkw77U.exe RegSvcs.exe PID 3952 wrote to memory of 3824 3952 B7hG4D8Jqvkw77U.exe RegSvcs.exe PID 3952 wrote to memory of 3824 3952 B7hG4D8Jqvkw77U.exe RegSvcs.exe PID 3952 wrote to memory of 3824 3952 B7hG4D8Jqvkw77U.exe RegSvcs.exe PID 3952 wrote to memory of 3824 3952 B7hG4D8Jqvkw77U.exe RegSvcs.exe PID 3952 wrote to memory of 3824 3952 B7hG4D8Jqvkw77U.exe RegSvcs.exe PID 3008 wrote to memory of 1684 3008 Explorer.EXE svchost.exe PID 3008 wrote to memory of 1684 3008 Explorer.EXE svchost.exe PID 3008 wrote to memory of 1684 3008 Explorer.EXE svchost.exe PID 1684 wrote to memory of 2456 1684 svchost.exe cmd.exe PID 1684 wrote to memory of 2456 1684 svchost.exe cmd.exe PID 1684 wrote to memory of 2456 1684 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\B7hG4D8Jqvkw77U.exe"C:\Users\Admin\AppData\Local\Temp\B7hG4D8Jqvkw77U.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1684-135-0x00000000035A0000-0x000000000362F000-memory.dmpFilesize
572KB
-
memory/1684-134-0x00000000030F0000-0x000000000323A000-memory.dmpFilesize
1.3MB
-
memory/1684-131-0x0000000000910000-0x000000000091C000-memory.dmpFilesize
48KB
-
memory/1684-132-0x00000000030C0000-0x00000000030E9000-memory.dmpFilesize
164KB
-
memory/1684-130-0x0000000000000000-mapping.dmp
-
memory/2456-133-0x0000000000000000-mapping.dmp
-
memory/3008-129-0x0000000006420000-0x000000000657F000-memory.dmpFilesize
1.4MB
-
memory/3008-136-0x0000000006580000-0x00000000066D5000-memory.dmpFilesize
1.3MB
-
memory/3824-126-0x000000000041D110-mapping.dmp
-
memory/3824-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3824-128-0x00000000011D0000-0x00000000011E0000-memory.dmpFilesize
64KB
-
memory/3824-127-0x0000000001250000-0x0000000001570000-memory.dmpFilesize
3.1MB
-
memory/3952-115-0x00000000008C0000-0x00000000008C1000-memory.dmpFilesize
4KB
-
memory/3952-124-0x0000000009DB0000-0x0000000009DDA000-memory.dmpFilesize
168KB
-
memory/3952-123-0x00000000076F0000-0x0000000007750000-memory.dmpFilesize
384KB
-
memory/3952-122-0x0000000005640000-0x0000000005656000-memory.dmpFilesize
88KB
-
memory/3952-121-0x00000000071C0000-0x00000000071C1000-memory.dmpFilesize
4KB
-
memory/3952-120-0x00000000051C0000-0x00000000051C1000-memory.dmpFilesize
4KB
-
memory/3952-119-0x00000000051F0000-0x00000000056EE000-memory.dmpFilesize
5.0MB
-
memory/3952-118-0x00000000051F0000-0x00000000051F1000-memory.dmpFilesize
4KB
-
memory/3952-117-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB