Analysis
-
max time kernel
300s -
max time network
301s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15-09-2021 16:42
Static task
static1
Behavioral task
behavioral1
Sample
TPJX2QwEdXs5sTV.exe
Resource
win7-en
General
-
Target
TPJX2QwEdXs5sTV.exe
-
Size
655KB
-
MD5
ce556ce97ea23cbc2940f2aad45d468f
-
SHA1
cc2bdaefa2f0ac108e2f456e42a42e8258580cf4
-
SHA256
7c3d5ebd2c417a52b2a0b98dee95b5a7f283816f6a2453ceeffd31becc140882
-
SHA512
82d4d71aeb5118d600394c64eb127ca4a87d7b83702feb4f9c5b0a0d98a597f812ebfd16784cbde54b9f4b1c87d3c7eaf57fb1c86b9720df95419887fc13f77b
Malware Config
Extracted
xloader
2.4
t75f
http://www.438451.com/t75f/
ice-lemon.pro
ar3spro.cloud
9055837.com
fucksociety.net
prettyofficialx.com
mfxw.xyz
relationshipquiz.info
customia.xyz
juanayjuan.com
zidiankj.com
facture-booking.com
secondmining.store
aboutyou.club
gongxichen.com
laurabraincreative.com
pierrot-bros.com
saintpaulaccountingservices.com
dom-maya.com
garderobamarzen.net
la-salamandre-assurances.com
pearmanprep.com
telfarcontrol.com
productsshareco.com
cirf2021.online
purchasevip.com
cakewalkvision.com
pointrenewables.com
groups4n.com
swnegce.xyz
tjapro.com
packagedesign.biz
services-govgr.cloud
shopgrassfedbeef.com
tquilaint.com
templetreemontessori.com
munortiete.com
nothingbutspotlesss.com
fanpaixiu.xyz
fr-site-amazon.com
salartfinance.com
beachers-shop.com
friskvardaportalen.online
pinsanova.site
lemonvinyl.online
indianadogeavaxsite.site
styphon.com
open24review-service.com
bdjh9.xyz
cocodiesel.com
fortmyersfl.deals
dsdtourism.com
phone-il.net
learningfactoryus.com
incentreward.xyz
travellerfund.com
changcheng.pro
cryptowalletts.com
tradopplst.xyz
autonomoustechnologyinc.com
assessmentdna.xyz
denicon-th.com
dib5so.com
genwealthbuilders.store
delnetitcilo.net
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/500-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/500-125-0x000000000041D410-mapping.dmp xloader behavioral2/memory/4040-133-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
colorcpl.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run colorcpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ZD5PLNDXGV = "C:\\Program Files (x86)\\Olhix2ppp\\bpxlvxdufw.exe" colorcpl.exe -
Executes dropped EXE 1 IoCs
Processes:
bpxlvxdufw.exepid process 3912 bpxlvxdufw.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
TPJX2QwEdXs5sTV.exeRegSvcs.execolorcpl.exedescription pid process target process PID 900 set thread context of 500 900 TPJX2QwEdXs5sTV.exe RegSvcs.exe PID 500 set thread context of 8 500 RegSvcs.exe Explorer.EXE PID 500 set thread context of 8 500 RegSvcs.exe Explorer.EXE PID 4040 set thread context of 8 4040 colorcpl.exe Explorer.EXE -
Drops file in Program Files directory 4 IoCs
Processes:
colorcpl.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Olhix2ppp\bpxlvxdufw.exe colorcpl.exe File opened for modification C:\Program Files (x86)\Olhix2ppp Explorer.EXE File created C:\Program Files (x86)\Olhix2ppp\bpxlvxdufw.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Olhix2ppp\bpxlvxdufw.exe Explorer.EXE -
Processes:
colorcpl.exedescription ioc process Key created \Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
TPJX2QwEdXs5sTV.exeRegSvcs.execolorcpl.exepid process 900 TPJX2QwEdXs5sTV.exe 900 TPJX2QwEdXs5sTV.exe 500 RegSvcs.exe 500 RegSvcs.exe 500 RegSvcs.exe 500 RegSvcs.exe 500 RegSvcs.exe 500 RegSvcs.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 8 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
RegSvcs.execolorcpl.exepid process 500 RegSvcs.exe 500 RegSvcs.exe 500 RegSvcs.exe 500 RegSvcs.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe 4040 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
TPJX2QwEdXs5sTV.exeRegSvcs.execolorcpl.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 900 TPJX2QwEdXs5sTV.exe Token: SeDebugPrivilege 500 RegSvcs.exe Token: SeDebugPrivilege 4040 colorcpl.exe Token: SeShutdownPrivilege 8 Explorer.EXE Token: SeCreatePagefilePrivilege 8 Explorer.EXE Token: SeShutdownPrivilege 8 Explorer.EXE Token: SeCreatePagefilePrivilege 8 Explorer.EXE Token: SeShutdownPrivilege 8 Explorer.EXE Token: SeCreatePagefilePrivilege 8 Explorer.EXE Token: SeShutdownPrivilege 8 Explorer.EXE Token: SeCreatePagefilePrivilege 8 Explorer.EXE Token: SeShutdownPrivilege 8 Explorer.EXE Token: SeCreatePagefilePrivilege 8 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 8 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
TPJX2QwEdXs5sTV.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 900 wrote to memory of 500 900 TPJX2QwEdXs5sTV.exe RegSvcs.exe PID 900 wrote to memory of 500 900 TPJX2QwEdXs5sTV.exe RegSvcs.exe PID 900 wrote to memory of 500 900 TPJX2QwEdXs5sTV.exe RegSvcs.exe PID 900 wrote to memory of 500 900 TPJX2QwEdXs5sTV.exe RegSvcs.exe PID 900 wrote to memory of 500 900 TPJX2QwEdXs5sTV.exe RegSvcs.exe PID 900 wrote to memory of 500 900 TPJX2QwEdXs5sTV.exe RegSvcs.exe PID 8 wrote to memory of 4040 8 Explorer.EXE colorcpl.exe PID 8 wrote to memory of 4040 8 Explorer.EXE colorcpl.exe PID 8 wrote to memory of 4040 8 Explorer.EXE colorcpl.exe PID 4040 wrote to memory of 4056 4040 colorcpl.exe cmd.exe PID 4040 wrote to memory of 4056 4040 colorcpl.exe cmd.exe PID 4040 wrote to memory of 4056 4040 colorcpl.exe cmd.exe PID 4040 wrote to memory of 2156 4040 colorcpl.exe Firefox.exe PID 4040 wrote to memory of 2156 4040 colorcpl.exe Firefox.exe PID 8 wrote to memory of 3912 8 Explorer.EXE bpxlvxdufw.exe PID 8 wrote to memory of 3912 8 Explorer.EXE bpxlvxdufw.exe PID 8 wrote to memory of 3912 8 Explorer.EXE bpxlvxdufw.exe PID 4040 wrote to memory of 2156 4040 colorcpl.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TPJX2QwEdXs5sTV.exe"C:\Users\Admin\AppData\Local\Temp\TPJX2QwEdXs5sTV.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Olhix2ppp\bpxlvxdufw.exe"C:\Program Files (x86)\Olhix2ppp\bpxlvxdufw.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Olhix2ppp\bpxlvxdufw.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Program Files (x86)\Olhix2ppp\bpxlvxdufw.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
memory/8-128-0x0000000005FB0000-0x000000000609E000-memory.dmpFilesize
952KB
-
memory/8-137-0x0000000008440000-0x00000000085B1000-memory.dmpFilesize
1.4MB
-
memory/8-130-0x0000000006350000-0x0000000006493000-memory.dmpFilesize
1.3MB
-
memory/500-129-0x0000000003030000-0x0000000003041000-memory.dmpFilesize
68KB
-
memory/500-125-0x000000000041D410-mapping.dmp
-
memory/500-126-0x0000000001310000-0x0000000001630000-memory.dmpFilesize
3.1MB
-
memory/500-127-0x00000000012D0000-0x00000000012E1000-memory.dmpFilesize
68KB
-
memory/500-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/900-119-0x00000000059B0000-0x00000000059B1000-memory.dmpFilesize
4KB
-
memory/900-123-0x000000000B940000-0x000000000B96B000-memory.dmpFilesize
172KB
-
memory/900-122-0x00000000076D0000-0x0000000007731000-memory.dmpFilesize
388KB
-
memory/900-120-0x0000000005E00000-0x0000000005E07000-memory.dmpFilesize
28KB
-
memory/900-121-0x0000000008FB0000-0x0000000008FB1000-memory.dmpFilesize
4KB
-
memory/900-118-0x0000000005920000-0x0000000005E1E000-memory.dmpFilesize
5.0MB
-
memory/900-117-0x00000000059C0000-0x00000000059C1000-memory.dmpFilesize
4KB
-
memory/900-114-0x0000000000F90000-0x0000000000F91000-memory.dmpFilesize
4KB
-
memory/900-116-0x0000000005E20000-0x0000000005E21000-memory.dmpFilesize
4KB
-
memory/2156-145-0x00007FF7921D0000-0x00007FF792263000-memory.dmpFilesize
588KB
-
memory/2156-146-0x00000154EB570000-0x00000154EB697000-memory.dmpFilesize
1.2MB
-
memory/2156-144-0x0000000000000000-mapping.dmp
-
memory/3912-138-0x0000000000000000-mapping.dmp
-
memory/3912-141-0x0000000000ED0000-0x0000000000ED1000-memory.dmpFilesize
4KB
-
memory/3912-142-0x00000000056A0000-0x00000000056A1000-memory.dmpFilesize
4KB
-
memory/3912-143-0x0000000003010000-0x0000000003011000-memory.dmpFilesize
4KB
-
memory/4040-136-0x0000000000DB0000-0x0000000000E40000-memory.dmpFilesize
576KB
-
memory/4040-135-0x0000000000F60000-0x0000000001280000-memory.dmpFilesize
3.1MB
-
memory/4040-133-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4040-132-0x00000000012F0000-0x0000000001309000-memory.dmpFilesize
100KB
-
memory/4040-131-0x0000000000000000-mapping.dmp
-
memory/4056-134-0x0000000000000000-mapping.dmp