Analysis
-
max time kernel
162s -
max time network
172s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
20-09-2021 20:04
Static task
static1
Behavioral task
behavioral1
Sample
aT8aer3ybNvYpl3.exe
Resource
win7-en-20210920
General
-
Target
aT8aer3ybNvYpl3.exe
-
Size
803KB
-
MD5
1eaf8232051d48b6207937c971965e2d
-
SHA1
0e1edb9297f0b7db297be69d4aee0c3a38eb7b84
-
SHA256
0693c816986f73899e351e1989103e680c336f401cca1d14f5bce3b5865cfee6
-
SHA512
c4d32524b6448e26a4aaa6224e6e55adbd040d2b1389cf5702386e7bf8a965232f8aa2b73d43b3da5424487e008fda05f003e280a233d6b1785374f7cc987d75
Malware Config
Extracted
xloader
2.5
gjeh
http://www.getaudionow.com/gjeh/
carmator.com
bsbqrp.com
siemens-mp.com
dunnfloorcoverings.com
cpassminimedicalschools.info
howtodesignyourhomeoffice.com
famliytaste.com
freesocialmarketing.com
jejuhaenyeo.net
tradebot.icu
arzug.com
carrefour-solucoes.online
ladyom.com
aoironote.com
newmexicocarwreckattorney.com
wealthpatternsllc.net
thinkpinkalicous.com
prajapati.company
bjhwky.com
jsdigitalekuns.com
hada-kirara.xyz
cryptochatr.com
ehao5ahhl6.com
i8news-sv.website
12sky2limitless.online
royalknightent.store
dualvisionproductions.com
nextgenerationracingleague.com
1dy17.xyz
vineethnekuri.com
offlces.com
mmpluk.com
4kwallpapers.online
yakyu-eiga.com
advertisingresult.com
ktshandymanservices.com
reyizz.com
ethics.tools
cyberbesttechnology.com
glopik.com
claybycollins.com
buythedamnbike.com
7q3qq3.com
normanwagers.com
editoramandacaia.com
fscmyc.com
contactosasi.com
brightpretty.com
glavins.net
demoxyz.online
apnagas.com
drdavesea.com
wholeheartedfounder.com
gunpowderz.com
thegliderguy.com
drawcen.com
7777wns.com
tecmovco.com
a3chic.com
alattarherbs.com
tracks-clicks.com
appioservice.com
matthewwesco.club
lampshadefish.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2100-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2100-125-0x000000000041D460-mapping.dmp xloader behavioral2/memory/1264-132-0x0000000002EF0000-0x0000000002F19000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
aT8aer3ybNvYpl3.exeRegSvcs.exeexplorer.exedescription pid process target process PID 1456 set thread context of 2100 1456 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 2100 set thread context of 3008 2100 RegSvcs.exe Explorer.EXE PID 1264 set thread context of 3008 1264 explorer.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
aT8aer3ybNvYpl3.exeRegSvcs.exeexplorer.exepid process 1456 aT8aer3ybNvYpl3.exe 1456 aT8aer3ybNvYpl3.exe 1456 aT8aer3ybNvYpl3.exe 1456 aT8aer3ybNvYpl3.exe 2100 RegSvcs.exe 2100 RegSvcs.exe 2100 RegSvcs.exe 2100 RegSvcs.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe 1264 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3008 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exeexplorer.exepid process 2100 RegSvcs.exe 2100 RegSvcs.exe 2100 RegSvcs.exe 1264 explorer.exe 1264 explorer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
aT8aer3ybNvYpl3.exeRegSvcs.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1456 aT8aer3ybNvYpl3.exe Token: SeDebugPrivilege 2100 RegSvcs.exe Token: SeDebugPrivilege 1264 explorer.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3008 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
aT8aer3ybNvYpl3.exeExplorer.EXEexplorer.exedescription pid process target process PID 1456 wrote to memory of 2096 1456 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 1456 wrote to memory of 2096 1456 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 1456 wrote to memory of 2096 1456 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 1456 wrote to memory of 2100 1456 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 1456 wrote to memory of 2100 1456 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 1456 wrote to memory of 2100 1456 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 1456 wrote to memory of 2100 1456 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 1456 wrote to memory of 2100 1456 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 1456 wrote to memory of 2100 1456 aT8aer3ybNvYpl3.exe RegSvcs.exe PID 3008 wrote to memory of 1264 3008 Explorer.EXE explorer.exe PID 3008 wrote to memory of 1264 3008 Explorer.EXE explorer.exe PID 3008 wrote to memory of 1264 3008 Explorer.EXE explorer.exe PID 1264 wrote to memory of 4068 1264 explorer.exe cmd.exe PID 1264 wrote to memory of 4068 1264 explorer.exe cmd.exe PID 1264 wrote to memory of 4068 1264 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aT8aer3ybNvYpl3.exe"C:\Users\Admin\AppData\Local\Temp\aT8aer3ybNvYpl3.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1264-134-0x0000000004560000-0x00000000045F0000-memory.dmpFilesize
576KB
-
memory/1264-132-0x0000000002EF0000-0x0000000002F19000-memory.dmpFilesize
164KB
-
memory/1264-131-0x0000000000310000-0x000000000074F000-memory.dmpFilesize
4.2MB
-
memory/1264-129-0x0000000000000000-mapping.dmp
-
memory/1264-133-0x0000000004810000-0x0000000004B30000-memory.dmpFilesize
3.1MB
-
memory/1456-118-0x0000000004B80000-0x000000000507E000-memory.dmpFilesize
5.0MB
-
memory/1456-121-0x0000000007200000-0x0000000007201000-memory.dmpFilesize
4KB
-
memory/1456-122-0x0000000007440000-0x00000000074A2000-memory.dmpFilesize
392KB
-
memory/1456-123-0x00000000074B0000-0x00000000074E3000-memory.dmpFilesize
204KB
-
memory/1456-120-0x0000000004BA0000-0x0000000004BBD000-memory.dmpFilesize
116KB
-
memory/1456-114-0x0000000000010000-0x0000000000011000-memory.dmpFilesize
4KB
-
memory/1456-119-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/1456-117-0x0000000004A40000-0x0000000004A41000-memory.dmpFilesize
4KB
-
memory/1456-116-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/2100-125-0x000000000041D460-mapping.dmp
-
memory/2100-126-0x0000000000A10000-0x0000000000D30000-memory.dmpFilesize
3.1MB
-
memory/2100-127-0x0000000000E60000-0x0000000000E71000-memory.dmpFilesize
68KB
-
memory/2100-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3008-128-0x0000000005350000-0x0000000005475000-memory.dmpFilesize
1.1MB
-
memory/3008-135-0x0000000005480000-0x00000000055CC000-memory.dmpFilesize
1.3MB
-
memory/4068-130-0x0000000000000000-mapping.dmp