Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en -
submitted
10-09-2021 07:52
Static task
static1
Behavioral task
behavioral1
Sample
4444.exe
Resource
win7-en
General
-
Target
4444.exe
-
Size
459KB
-
MD5
a3e29a08e40f22092782a69ada250f36
-
SHA1
5597636fe0d024ad1831b30cc5b16764847a2085
-
SHA256
4a91d8f52d07bcd7fde157c6b56e2881c4abba94a0f7921633da4ae2bba53074
-
SHA512
b8060bf8147e9659790957f42c6ce5b8906f862e57f20c810d4bf12e48174e8a9fccb6f9842713f4079e3ec95bef3a4489873faaf970e3db388b1923b35dd8f7
Malware Config
Extracted
xloader
2.3
t75f
http://www.vertexnailsblaine.com/t75f/
onegolfsydney.com
kaizensportscoaching.com
mliacbjv.icu
rinstech.net
midas-parts.com
istmenian.com
ibrahimpike.com
herbspaces.com
gentleman4higher.com
workabusiness.com
isabusive.website
222555dy.com
lwhyzhzb.xyz
gabrielabravoillanes.com
hearthomelife.com
buildswealth.com
printitaz.com
l-mventures.com
baincot3.com
nstaq-labs.com
wikendi.com
newyears21.com
citestaccnt1597730671.com
thecuriousincidentwes.com
alchembiopro.com
stardustanimations.com
ssgasiaw.com
sarajanesstudio.com
whitepointfineart.com
dlglawtx.com
doudiangroup.com
jackpod.team
abvoltprunus.bid
miimamablog.com
selfbuildwithmannok.com
thanhxuan99.online
germantos.com
waterdoor.net
wmscloud.net
services-24hras.com
maneadvisors.com
mosineetowing.com
blockdelightsmart.com
booyaka.design
brewery-run.com
dexteroushandmade.com
minhamochila.com
drawingwoo.com
thesalcombefurniturecompany.net
nashautoglass.com
beenationgear.com
cleanseforlifewellness.com
corecounselingcenter.info
naturalcreativesociety.com
sarcontraders.com
lickitbuddyrehab.com
theweekendrecap.com
cetiya-veluvana.com
w7asd.net
nyctophilia.net
asialion.net
goldentreegrp.com
jacobuspark.com
punchingforce.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4172-126-0x000000000041D110-mapping.dmp xloader behavioral2/memory/4172-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4192-133-0x0000000000AA0000-0x0000000000AC9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
4444.exeRegSvcs.exeNETSTAT.EXEdescription pid process target process PID 4472 set thread context of 4172 4472 4444.exe RegSvcs.exe PID 4172 set thread context of 2996 4172 RegSvcs.exe Explorer.EXE PID 4192 set thread context of 2996 4192 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 4192 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
4444.exeRegSvcs.exeNETSTAT.EXEpid process 4472 4444.exe 4472 4444.exe 4172 RegSvcs.exe 4172 RegSvcs.exe 4172 RegSvcs.exe 4172 RegSvcs.exe 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE 4192 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2996 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exeNETSTAT.EXEpid process 4172 RegSvcs.exe 4172 RegSvcs.exe 4172 RegSvcs.exe 4192 NETSTAT.EXE 4192 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
4444.exeRegSvcs.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 4472 4444.exe Token: SeDebugPrivilege 4172 RegSvcs.exe Token: SeDebugPrivilege 4192 NETSTAT.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2996 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
4444.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 4472 wrote to memory of 4172 4472 4444.exe RegSvcs.exe PID 4472 wrote to memory of 4172 4472 4444.exe RegSvcs.exe PID 4472 wrote to memory of 4172 4472 4444.exe RegSvcs.exe PID 4472 wrote to memory of 4172 4472 4444.exe RegSvcs.exe PID 4472 wrote to memory of 4172 4472 4444.exe RegSvcs.exe PID 4472 wrote to memory of 4172 4472 4444.exe RegSvcs.exe PID 2996 wrote to memory of 4192 2996 Explorer.EXE NETSTAT.EXE PID 2996 wrote to memory of 4192 2996 Explorer.EXE NETSTAT.EXE PID 2996 wrote to memory of 4192 2996 Explorer.EXE NETSTAT.EXE PID 4192 wrote to memory of 4304 4192 NETSTAT.EXE cmd.exe PID 4192 wrote to memory of 4304 4192 NETSTAT.EXE cmd.exe PID 4192 wrote to memory of 4304 4192 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4444.exe"C:\Users\Admin\AppData\Local\Temp\4444.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2996-136-0x0000000004DD0000-0x0000000004ED1000-memory.dmpFilesize
1.0MB
-
memory/2996-129-0x0000000004C60000-0x0000000004DCB000-memory.dmpFilesize
1.4MB
-
memory/4172-126-0x000000000041D110-mapping.dmp
-
memory/4172-127-0x0000000000E40000-0x0000000001160000-memory.dmpFilesize
3.1MB
-
memory/4172-128-0x0000000000570000-0x0000000000580000-memory.dmpFilesize
64KB
-
memory/4172-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4192-131-0x0000000000E20000-0x0000000000E2B000-memory.dmpFilesize
44KB
-
memory/4192-130-0x0000000000000000-mapping.dmp
-
memory/4192-135-0x0000000003080000-0x000000000310F000-memory.dmpFilesize
572KB
-
memory/4192-134-0x0000000003320000-0x0000000003640000-memory.dmpFilesize
3.1MB
-
memory/4192-133-0x0000000000AA0000-0x0000000000AC9000-memory.dmpFilesize
164KB
-
memory/4304-132-0x0000000000000000-mapping.dmp
-
memory/4472-121-0x00000000074C0000-0x00000000074C1000-memory.dmpFilesize
4KB
-
memory/4472-118-0x0000000005950000-0x0000000005951000-memory.dmpFilesize
4KB
-
memory/4472-119-0x00000000059F0000-0x00000000059F1000-memory.dmpFilesize
4KB
-
memory/4472-115-0x0000000000F50000-0x0000000000F51000-memory.dmpFilesize
4KB
-
memory/4472-120-0x00000000058B0000-0x0000000005942000-memory.dmpFilesize
584KB
-
memory/4472-123-0x0000000007750000-0x00000000077B0000-memory.dmpFilesize
384KB
-
memory/4472-122-0x0000000005CE0000-0x0000000005CE7000-memory.dmpFilesize
28KB
-
memory/4472-124-0x000000000B890000-0x000000000B8BA000-memory.dmpFilesize
168KB
-
memory/4472-117-0x0000000005F20000-0x0000000005F21000-memory.dmpFilesize
4KB