Analysis
-
max time kernel
151s -
max time network
172s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
10-09-2021 09:11
Static task
static1
Behavioral task
behavioral1
Sample
B1o.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
B1o.exe
Resource
win10-en
General
-
Target
B1o.exe
-
Size
614KB
-
MD5
5e3dc4e700d55cb8232bdbeade8ca8ad
-
SHA1
8a4c46e292dafb7db736c03f784a997b6dece9aa
-
SHA256
00aa65bb6c94d28f04933ebc90a56bf75d62ac3cd246afa1ef60d671a40ee978
-
SHA512
6b1d6e010c303ea7663f33d82255eea9f0c0c2b941301788b3e811138c1f08021b922e4a63426b2f3deb00d5b36e4d2eed3ea640a7562998836b87e2bfa02cf9
Malware Config
Extracted
xloader
2.3
chg
http://www.chiaketo.com/chg/
worldvaypg.com
cremationprosguiding.info
counterpub.com
steamed-chicken.com
bethhavencemetery.com
wanda12.com
thejdot.com
juliusbuckley.com
realloveawaitsnow.com
healthandenergyadvisors.com
stockholmfasadputs.com
uvsafetysolutions.com
mamucosmetic.com
konoozalyemen.com
grillschalen.com
zljmys.com
paradseautos.com
home360.asia
domentemenegi37.com
farazahmadosama.com
phpman.info
momenwang.com
globalstressengineers.info
syu38.com
thegiftsofmentalillness.com
bytephunk.com
boutiquedmcretreats.com
jialongvideo.com
736spadina.com
omicai.com
brandonneffdesign.com
simranmahindrakar.com
kashmirishoping.com
pinggutech.com
shangjingtang.com
sweetdesignsbykathy.com
rcengichem.com
smart-money-gal.com
ilbfoundation.com
hairstage.xyz
xn--buildenv-bdb.com
covidrecess.com
masihkecewa.com
mnt-sa.net
arcturus-realty.com
gameonaustralia.com
khanamericantools.com
grabbarquote.com
mamentos.info
zero-nezumi.com
fastfoodchicago.com
bikalu.com
powersmoney.com
ninisex.com
hntbank.com
aacj.ink
84streetchamber.com
saharamoverspackers.com
ellibromagico.com
itscat.xyz
woodlandsandthyme.com
avcitoptan.com
industrialareadirectory.com
glendadestatesteam.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1788-62-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1788-64-0x000000000041D030-mapping.dmp xloader behavioral1/memory/1888-70-0x0000000000080000-0x00000000000A8000-memory.dmp xloader -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
B1o.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yjvkalu = "C:\\Users\\Public\\Libraries\\ulakvjY.url" B1o.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
B1o.exeB1o.execmd.exedescription pid process target process PID 1824 set thread context of 1788 1824 B1o.exe B1o.exe PID 1788 set thread context of 1212 1788 B1o.exe Explorer.EXE PID 1888 set thread context of 1212 1888 cmd.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
B1o.execmd.exepid process 1788 B1o.exe 1788 B1o.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe 1888 cmd.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
B1o.execmd.exepid process 1788 B1o.exe 1788 B1o.exe 1788 B1o.exe 1888 cmd.exe 1888 cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
B1o.execmd.exedescription pid process Token: SeDebugPrivilege 1788 B1o.exe Token: SeDebugPrivilege 1888 cmd.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
B1o.exeExplorer.EXEdescription pid process target process PID 1824 wrote to memory of 1788 1824 B1o.exe B1o.exe PID 1824 wrote to memory of 1788 1824 B1o.exe B1o.exe PID 1824 wrote to memory of 1788 1824 B1o.exe B1o.exe PID 1824 wrote to memory of 1788 1824 B1o.exe B1o.exe PID 1824 wrote to memory of 1788 1824 B1o.exe B1o.exe PID 1824 wrote to memory of 1788 1824 B1o.exe B1o.exe PID 1824 wrote to memory of 1788 1824 B1o.exe B1o.exe PID 1212 wrote to memory of 1888 1212 Explorer.EXE cmd.exe PID 1212 wrote to memory of 1888 1212 Explorer.EXE cmd.exe PID 1212 wrote to memory of 1888 1212 Explorer.EXE cmd.exe PID 1212 wrote to memory of 1888 1212 Explorer.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\B1o.exe"C:\Users\Admin\AppData\Local\Temp\B1o.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\B1o.exe"C:\Users\Admin\AppData\Local\Temp\B1o.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1212-67-0x0000000003E20000-0x0000000003EEA000-memory.dmpFilesize
808KB
-
memory/1212-73-0x0000000004E80000-0x0000000004FBF000-memory.dmpFilesize
1.2MB
-
memory/1788-64-0x000000000041D030-mapping.dmp
-
memory/1788-66-0x0000000000260000-0x0000000000270000-memory.dmpFilesize
64KB
-
memory/1788-65-0x0000000000920000-0x0000000000C23000-memory.dmpFilesize
3.0MB
-
memory/1788-62-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1824-60-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1824-61-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/1888-68-0x0000000000000000-mapping.dmp
-
memory/1888-69-0x0000000049E20000-0x0000000049E6C000-memory.dmpFilesize
304KB
-
memory/1888-70-0x0000000000080000-0x00000000000A8000-memory.dmpFilesize
160KB
-
memory/1888-71-0x0000000001FF0000-0x00000000022F3000-memory.dmpFilesize
3.0MB
-
memory/1888-72-0x0000000001EF0000-0x0000000001F7F000-memory.dmpFilesize
572KB