Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
20-09-2021 20:04
Static task
static1
Behavioral task
behavioral1
Sample
aT8aer3ybNvYpl3.exe
Resource
win7-en-20210920
General
-
Target
aT8aer3ybNvYpl3.exe
-
Size
803KB
-
MD5
1eaf8232051d48b6207937c971965e2d
-
SHA1
0e1edb9297f0b7db297be69d4aee0c3a38eb7b84
-
SHA256
0693c816986f73899e351e1989103e680c336f401cca1d14f5bce3b5865cfee6
-
SHA512
c4d32524b6448e26a4aaa6224e6e55adbd040d2b1389cf5702386e7bf8a965232f8aa2b73d43b3da5424487e008fda05f003e280a233d6b1785374f7cc987d75
Malware Config
Extracted
xloader
2.5
gjeh
http://www.getaudionow.com/gjeh/
carmator.com
bsbqrp.com
siemens-mp.com
dunnfloorcoverings.com
cpassminimedicalschools.info
howtodesignyourhomeoffice.com
famliytaste.com
freesocialmarketing.com
jejuhaenyeo.net
tradebot.icu
arzug.com
carrefour-solucoes.online
ladyom.com
aoironote.com
newmexicocarwreckattorney.com
wealthpatternsllc.net
thinkpinkalicous.com
prajapati.company
bjhwky.com
jsdigitalekuns.com
hada-kirara.xyz
cryptochatr.com
ehao5ahhl6.com
i8news-sv.website
12sky2limitless.online
royalknightent.store
dualvisionproductions.com
nextgenerationracingleague.com
1dy17.xyz
vineethnekuri.com
offlces.com
mmpluk.com
4kwallpapers.online
yakyu-eiga.com
advertisingresult.com
ktshandymanservices.com
reyizz.com
ethics.tools
cyberbesttechnology.com
glopik.com
claybycollins.com
buythedamnbike.com
7q3qq3.com
normanwagers.com
editoramandacaia.com
fscmyc.com
contactosasi.com
brightpretty.com
glavins.net
demoxyz.online
apnagas.com
drdavesea.com
wholeheartedfounder.com
gunpowderz.com
thegliderguy.com
drawcen.com
7777wns.com
tecmovco.com
a3chic.com
alattarherbs.com
tracks-clicks.com
appioservice.com
matthewwesco.club
lampshadefish.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1664-59-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1664-60-0x000000000041D460-mapping.dmp xloader behavioral1/memory/1880-69-0x0000000000090000-0x00000000000B9000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
aT8aer3ybNvYpl3.exeRegSvcs.exemsiexec.exedescription pid process target process PID 1540 set thread context of 1664 1540 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 1664 set thread context of 1356 1664 RegSvcs.exe Explorer.EXE PID 1664 set thread context of 1356 1664 RegSvcs.exe Explorer.EXE PID 1880 set thread context of 1356 1880 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
aT8aer3ybNvYpl3.exeRegSvcs.exemsiexec.exepid process 1540 aT8aer3ybNvYpl3.exe 1540 aT8aer3ybNvYpl3.exe 1664 RegSvcs.exe 1664 RegSvcs.exe 1664 RegSvcs.exe 1880 msiexec.exe 1880 msiexec.exe 1880 msiexec.exe 1880 msiexec.exe 1880 msiexec.exe 1880 msiexec.exe 1880 msiexec.exe 1880 msiexec.exe 1880 msiexec.exe 1880 msiexec.exe 1880 msiexec.exe 1880 msiexec.exe 1880 msiexec.exe 1880 msiexec.exe 1880 msiexec.exe 1880 msiexec.exe 1880 msiexec.exe 1880 msiexec.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.exemsiexec.exepid process 1664 RegSvcs.exe 1664 RegSvcs.exe 1664 RegSvcs.exe 1664 RegSvcs.exe 1880 msiexec.exe 1880 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
aT8aer3ybNvYpl3.exeRegSvcs.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1540 aT8aer3ybNvYpl3.exe Token: SeDebugPrivilege 1664 RegSvcs.exe Token: SeDebugPrivilege 1880 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1356 Explorer.EXE 1356 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1356 Explorer.EXE 1356 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
aT8aer3ybNvYpl3.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1540 wrote to memory of 1664 1540 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 1540 wrote to memory of 1664 1540 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 1540 wrote to memory of 1664 1540 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 1540 wrote to memory of 1664 1540 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 1540 wrote to memory of 1664 1540 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 1540 wrote to memory of 1664 1540 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 1540 wrote to memory of 1664 1540 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 1540 wrote to memory of 1664 1540 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 1540 wrote to memory of 1664 1540 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 1540 wrote to memory of 1664 1540 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 1356 wrote to memory of 1880 1356 Explorer.EXE msiexec.exe PID 1356 wrote to memory of 1880 1356 Explorer.EXE msiexec.exe PID 1356 wrote to memory of 1880 1356 Explorer.EXE msiexec.exe PID 1356 wrote to memory of 1880 1356 Explorer.EXE msiexec.exe PID 1356 wrote to memory of 1880 1356 Explorer.EXE msiexec.exe PID 1356 wrote to memory of 1880 1356 Explorer.EXE msiexec.exe PID 1356 wrote to memory of 1880 1356 Explorer.EXE msiexec.exe PID 1880 wrote to memory of 472 1880 msiexec.exe cmd.exe PID 1880 wrote to memory of 472 1880 msiexec.exe cmd.exe PID 1880 wrote to memory of 472 1880 msiexec.exe cmd.exe PID 1880 wrote to memory of 472 1880 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aT8aer3ybNvYpl3.exe"C:\Users\Admin\AppData\Local\Temp\aT8aer3ybNvYpl3.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/472-70-0x0000000000000000-mapping.dmp
-
memory/1356-63-0x0000000006480000-0x00000000065B4000-memory.dmpFilesize
1.2MB
-
memory/1356-73-0x0000000008C30000-0x0000000008D7C000-memory.dmpFilesize
1.3MB
-
memory/1356-65-0x0000000006AD0000-0x0000000006C78000-memory.dmpFilesize
1.7MB
-
memory/1540-55-0x00000000004D0000-0x00000000004ED000-memory.dmpFilesize
116KB
-
memory/1540-56-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/1540-57-0x0000000004F40000-0x0000000004FA2000-memory.dmpFilesize
392KB
-
memory/1540-58-0x0000000000AC0000-0x0000000000AF3000-memory.dmpFilesize
204KB
-
memory/1540-53-0x0000000000EF0000-0x0000000000EF1000-memory.dmpFilesize
4KB
-
memory/1664-64-0x0000000000270000-0x0000000000281000-memory.dmpFilesize
68KB
-
memory/1664-62-0x0000000000150000-0x0000000000161000-memory.dmpFilesize
68KB
-
memory/1664-61-0x0000000000900000-0x0000000000C03000-memory.dmpFilesize
3.0MB
-
memory/1664-60-0x000000000041D460-mapping.dmp
-
memory/1664-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1880-66-0x0000000000000000-mapping.dmp
-
memory/1880-67-0x0000000075A71000-0x0000000075A73000-memory.dmpFilesize
8KB
-
memory/1880-68-0x00000000002B0000-0x00000000002C4000-memory.dmpFilesize
80KB
-
memory/1880-69-0x0000000000090000-0x00000000000B9000-memory.dmpFilesize
164KB
-
memory/1880-71-0x00000000021D0000-0x00000000024D3000-memory.dmpFilesize
3.0MB
-
memory/1880-72-0x0000000001FA0000-0x0000000002030000-memory.dmpFilesize
576KB