Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows7_x64 -
resource
win7-en-20210916 -
submitted
19-09-2021 17:07
Static task
static1
Behavioral task
behavioral1
Sample
truck pictures.exe
Resource
win7-en-20210916
General
-
Target
truck pictures.exe
-
Size
634KB
-
MD5
99ed5f72e5742e549a6ec78655fd3cfc
-
SHA1
31a4f6fc81c45e49f4787cebe622256fa74d8a06
-
SHA256
5c8f31380d956958134331ea55e63835fd16ca1f02f4c81672b69db70bc97ab8
-
SHA512
45abc2973402ba0ae81b4e708c257c9e8f5fe472b1fdf969766697a5226481764b0bf8d9be8dd99effd47e7556ed0110b48b892c315d850b952ed700ac2f9711
Malware Config
Extracted
xloader
2.5
cuig
http://www.qtih.top/cuig/
sofiathinks-elderly.net
lahamicoast.info
2shengman.com
cbsautoplex.com
arcana-candles.com
genrage.com
kukumiou.xyz
thequizerking.com
sonataproductions.com
rebuildgomnmf.xyz
ubcoin.store
yiyouxue.net
firstlifehome.com
mdx-inc.net
gotbn-c01.com
dinobrindes.store
jcm-iso.com
cliente-mais.com
mloujewelry.com
correoversoi.quest
rc-rental-housing.com
swisstrustcitybank.com
traderjoes-corp.com
mandolinmeditations.com
kathcorp.com
mcdonaldsfastdel.xyz
nielsqanalytics.com
bansity.com
mimosymas.com
atp-cayenne.com
sinterekes.com
nnxsk.com
shushigallery.tech
thgn41.xyz
resporn.tech
growingki.com
themyopiatoolbox.com
angeleyesevents.com
reddishgomjtd.xyz
amazonretailbrickandmotar.net
jewelrybyjma.com
ctroutdoors.pro
357961.com
theakfam.business
skincarefamily.com
xptoempeendimentos.com
tapestrirewards.com
viridilodge.com
bostondowntownrealestate.com
disrepairclaimsuk.com
makaroff.net
thedoublezbar.com
barbicidemalaysia.com
sliv-a.online
showgeini.com
martialartsreigns.online
metamode.space
ch95516.ink
halvorson-pickup.com
mizuno-trouble.net
46dgj.xyz
esylf4vt.xyz
chopaap.com
igorleonardo.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1004-60-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1004-61-0x000000000041D3F0-mapping.dmp xloader behavioral1/memory/1808-68-0x00000000000C0000-0x00000000000E9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 296 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
truck pictures.exetruck pictures.execontrol.exedescription pid process target process PID 1916 set thread context of 1004 1916 truck pictures.exe truck pictures.exe PID 1004 set thread context of 1216 1004 truck pictures.exe Explorer.EXE PID 1808 set thread context of 1216 1808 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
truck pictures.exetruck pictures.execontrol.exepid process 1916 truck pictures.exe 1916 truck pictures.exe 1916 truck pictures.exe 1916 truck pictures.exe 1916 truck pictures.exe 1916 truck pictures.exe 1916 truck pictures.exe 1004 truck pictures.exe 1004 truck pictures.exe 1808 control.exe 1808 control.exe 1808 control.exe 1808 control.exe 1808 control.exe 1808 control.exe 1808 control.exe 1808 control.exe 1808 control.exe 1808 control.exe 1808 control.exe 1808 control.exe 1808 control.exe 1808 control.exe 1808 control.exe 1808 control.exe 1808 control.exe 1808 control.exe 1808 control.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
truck pictures.execontrol.exepid process 1004 truck pictures.exe 1004 truck pictures.exe 1004 truck pictures.exe 1808 control.exe 1808 control.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
truck pictures.exetruck pictures.execontrol.exedescription pid process Token: SeDebugPrivilege 1916 truck pictures.exe Token: SeDebugPrivilege 1004 truck pictures.exe Token: SeDebugPrivilege 1808 control.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
truck pictures.exeExplorer.EXEcontrol.exedescription pid process target process PID 1916 wrote to memory of 1004 1916 truck pictures.exe truck pictures.exe PID 1916 wrote to memory of 1004 1916 truck pictures.exe truck pictures.exe PID 1916 wrote to memory of 1004 1916 truck pictures.exe truck pictures.exe PID 1916 wrote to memory of 1004 1916 truck pictures.exe truck pictures.exe PID 1916 wrote to memory of 1004 1916 truck pictures.exe truck pictures.exe PID 1916 wrote to memory of 1004 1916 truck pictures.exe truck pictures.exe PID 1916 wrote to memory of 1004 1916 truck pictures.exe truck pictures.exe PID 1216 wrote to memory of 1808 1216 Explorer.EXE control.exe PID 1216 wrote to memory of 1808 1216 Explorer.EXE control.exe PID 1216 wrote to memory of 1808 1216 Explorer.EXE control.exe PID 1216 wrote to memory of 1808 1216 Explorer.EXE control.exe PID 1808 wrote to memory of 296 1808 control.exe cmd.exe PID 1808 wrote to memory of 296 1808 control.exe cmd.exe PID 1808 wrote to memory of 296 1808 control.exe cmd.exe PID 1808 wrote to memory of 296 1808 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\truck pictures.exe"C:\Users\Admin\AppData\Local\Temp\truck pictures.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\truck pictures.exe"C:\Users\Admin\AppData\Local\Temp\truck pictures.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\truck pictures.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/296-70-0x0000000000000000-mapping.dmp
-
memory/1004-62-0x0000000000840000-0x0000000000B43000-memory.dmpFilesize
3.0MB
-
memory/1004-63-0x0000000000450000-0x0000000000461000-memory.dmpFilesize
68KB
-
memory/1004-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1004-61-0x000000000041D3F0-mapping.dmp
-
memory/1216-72-0x0000000004F50000-0x000000000509C000-memory.dmpFilesize
1.3MB
-
memory/1216-64-0x0000000004A30000-0x0000000004B3A000-memory.dmpFilesize
1.0MB
-
memory/1808-68-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/1808-65-0x0000000000000000-mapping.dmp
-
memory/1808-66-0x0000000075241000-0x0000000075243000-memory.dmpFilesize
8KB
-
memory/1808-67-0x0000000000C70000-0x0000000000C8F000-memory.dmpFilesize
124KB
-
memory/1808-69-0x0000000002090000-0x0000000002393000-memory.dmpFilesize
3.0MB
-
memory/1808-71-0x00000000008A0000-0x0000000000930000-memory.dmpFilesize
576KB
-
memory/1916-59-0x0000000000AF0000-0x0000000000B1B000-memory.dmpFilesize
172KB
-
memory/1916-58-0x0000000004D60000-0x0000000004DC0000-memory.dmpFilesize
384KB
-
memory/1916-54-0x0000000001110000-0x0000000001111000-memory.dmpFilesize
4KB
-
memory/1916-57-0x0000000000420000-0x0000000000427000-memory.dmpFilesize
28KB
-
memory/1916-56-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB