Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en -
submitted
10-09-2021 09:11
Static task
static1
Behavioral task
behavioral1
Sample
B1o.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
B1o.exe
Resource
win10-en
General
-
Target
B1o.exe
-
Size
614KB
-
MD5
5e3dc4e700d55cb8232bdbeade8ca8ad
-
SHA1
8a4c46e292dafb7db736c03f784a997b6dece9aa
-
SHA256
00aa65bb6c94d28f04933ebc90a56bf75d62ac3cd246afa1ef60d671a40ee978
-
SHA512
6b1d6e010c303ea7663f33d82255eea9f0c0c2b941301788b3e811138c1f08021b922e4a63426b2f3deb00d5b36e4d2eed3ea640a7562998836b87e2bfa02cf9
Malware Config
Extracted
xloader
2.3
chg
http://www.chiaketo.com/chg/
worldvaypg.com
cremationprosguiding.info
counterpub.com
steamed-chicken.com
bethhavencemetery.com
wanda12.com
thejdot.com
juliusbuckley.com
realloveawaitsnow.com
healthandenergyadvisors.com
stockholmfasadputs.com
uvsafetysolutions.com
mamucosmetic.com
konoozalyemen.com
grillschalen.com
zljmys.com
paradseautos.com
home360.asia
domentemenegi37.com
farazahmadosama.com
phpman.info
momenwang.com
globalstressengineers.info
syu38.com
thegiftsofmentalillness.com
bytephunk.com
boutiquedmcretreats.com
jialongvideo.com
736spadina.com
omicai.com
brandonneffdesign.com
simranmahindrakar.com
kashmirishoping.com
pinggutech.com
shangjingtang.com
sweetdesignsbykathy.com
rcengichem.com
smart-money-gal.com
ilbfoundation.com
hairstage.xyz
xn--buildenv-bdb.com
covidrecess.com
masihkecewa.com
mnt-sa.net
arcturus-realty.com
gameonaustralia.com
khanamericantools.com
grabbarquote.com
mamentos.info
zero-nezumi.com
fastfoodchicago.com
bikalu.com
powersmoney.com
ninisex.com
hntbank.com
aacj.ink
84streetchamber.com
saharamoverspackers.com
ellibromagico.com
itscat.xyz
woodlandsandthyme.com
avcitoptan.com
industrialareadirectory.com
glendadestatesteam.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2328-116-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/2328-118-0x000000000041D030-mapping.dmp xloader behavioral2/memory/2728-124-0x00000000007C0000-0x00000000007E8000-memory.dmp xloader -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
B1o.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yjvkalu = "C:\\Users\\Public\\Libraries\\ulakvjY.url" B1o.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
B1o.exeB1o.execolorcpl.exedescription pid process target process PID 3996 set thread context of 2328 3996 B1o.exe B1o.exe PID 2328 set thread context of 2964 2328 B1o.exe Explorer.EXE PID 2728 set thread context of 2964 2728 colorcpl.exe Explorer.EXE -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3952 3996 WerFault.exe B1o.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeB1o.execolorcpl.exepid process 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 2328 B1o.exe 2328 B1o.exe 2328 B1o.exe 2328 B1o.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe 2728 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2964 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
B1o.execolorcpl.exepid process 2328 B1o.exe 2328 B1o.exe 2328 B1o.exe 2728 colorcpl.exe 2728 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
WerFault.exeB1o.execolorcpl.exedescription pid process Token: SeRestorePrivilege 3952 WerFault.exe Token: SeBackupPrivilege 3952 WerFault.exe Token: SeDebugPrivilege 3952 WerFault.exe Token: SeDebugPrivilege 2328 B1o.exe Token: SeDebugPrivilege 2728 colorcpl.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2964 Explorer.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
B1o.exeExplorer.EXEdescription pid process target process PID 3996 wrote to memory of 2328 3996 B1o.exe B1o.exe PID 3996 wrote to memory of 2328 3996 B1o.exe B1o.exe PID 3996 wrote to memory of 2328 3996 B1o.exe B1o.exe PID 3996 wrote to memory of 2328 3996 B1o.exe B1o.exe PID 3996 wrote to memory of 2328 3996 B1o.exe B1o.exe PID 3996 wrote to memory of 2328 3996 B1o.exe B1o.exe PID 2964 wrote to memory of 2728 2964 Explorer.EXE colorcpl.exe PID 2964 wrote to memory of 2728 2964 Explorer.EXE colorcpl.exe PID 2964 wrote to memory of 2728 2964 Explorer.EXE colorcpl.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\B1o.exe"C:\Users\Admin\AppData\Local\Temp\B1o.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 13123⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\B1o.exe"C:\Users\Admin\AppData\Local\Temp\B1o.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2328-116-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2328-118-0x000000000041D030-mapping.dmp
-
memory/2328-120-0x0000000000430000-0x00000000004DE000-memory.dmpFilesize
696KB
-
memory/2328-119-0x0000000000A20000-0x0000000000D40000-memory.dmpFilesize
3.1MB
-
memory/2728-122-0x0000000000000000-mapping.dmp
-
memory/2728-123-0x0000000000B70000-0x0000000000B89000-memory.dmpFilesize
100KB
-
memory/2728-124-0x00000000007C0000-0x00000000007E8000-memory.dmpFilesize
160KB
-
memory/2728-125-0x0000000004990000-0x0000000004CB0000-memory.dmpFilesize
3.1MB
-
memory/2728-126-0x0000000004810000-0x000000000489F000-memory.dmpFilesize
572KB
-
memory/2964-121-0x0000000002480000-0x000000000254E000-memory.dmpFilesize
824KB
-
memory/2964-127-0x0000000005090000-0x00000000051A6000-memory.dmpFilesize
1.1MB
-
memory/3996-115-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB