Analysis
-
max time kernel
297s -
max time network
302s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
24-09-2021 11:59
Static task
static1
Behavioral task
behavioral1
Sample
B1o.exe
Resource
win7v20210408
General
-
Target
B1o.exe
-
Size
614KB
-
MD5
5e3dc4e700d55cb8232bdbeade8ca8ad
-
SHA1
8a4c46e292dafb7db736c03f784a997b6dece9aa
-
SHA256
00aa65bb6c94d28f04933ebc90a56bf75d62ac3cd246afa1ef60d671a40ee978
-
SHA512
6b1d6e010c303ea7663f33d82255eea9f0c0c2b941301788b3e811138c1f08021b922e4a63426b2f3deb00d5b36e4d2eed3ea640a7562998836b87e2bfa02cf9
Malware Config
Extracted
xloader
2.3
chg
http://www.chiaketo.com/chg/
worldvaypg.com
cremationprosguiding.info
counterpub.com
steamed-chicken.com
bethhavencemetery.com
wanda12.com
thejdot.com
juliusbuckley.com
realloveawaitsnow.com
healthandenergyadvisors.com
stockholmfasadputs.com
uvsafetysolutions.com
mamucosmetic.com
konoozalyemen.com
grillschalen.com
zljmys.com
paradseautos.com
home360.asia
domentemenegi37.com
farazahmadosama.com
phpman.info
momenwang.com
globalstressengineers.info
syu38.com
thegiftsofmentalillness.com
bytephunk.com
boutiquedmcretreats.com
jialongvideo.com
736spadina.com
omicai.com
brandonneffdesign.com
simranmahindrakar.com
kashmirishoping.com
pinggutech.com
shangjingtang.com
sweetdesignsbykathy.com
rcengichem.com
smart-money-gal.com
ilbfoundation.com
hairstage.xyz
xn--buildenv-bdb.com
covidrecess.com
masihkecewa.com
mnt-sa.net
arcturus-realty.com
gameonaustralia.com
khanamericantools.com
grabbarquote.com
mamentos.info
zero-nezumi.com
fastfoodchicago.com
bikalu.com
powersmoney.com
ninisex.com
hntbank.com
aacj.ink
84streetchamber.com
saharamoverspackers.com
ellibromagico.com
itscat.xyz
woodlandsandthyme.com
avcitoptan.com
industrialareadirectory.com
glendadestatesteam.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4092-116-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/4092-118-0x000000000041D030-mapping.dmp xloader behavioral2/memory/2924-124-0x0000000002B50000-0x0000000002B78000-memory.dmp xloader -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
B1o.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yjvkalu = "C:\\Users\\Public\\Libraries\\ulakvjY.url" B1o.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
B1o.exeB1o.execmmon32.exedescription pid process target process PID 2404 set thread context of 4092 2404 B1o.exe B1o.exe PID 4092 set thread context of 392 4092 B1o.exe Explorer.EXE PID 2924 set thread context of 392 2924 cmmon32.exe Explorer.EXE -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3116 2404 WerFault.exe B1o.exe -
Processes:
cmmon32.exedescription ioc process Key created \Registry\User\S-1-5-21-2481030822-2828258191-1606198294-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmmon32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeB1o.execmmon32.exepid process 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 3116 WerFault.exe 4092 B1o.exe 4092 B1o.exe 4092 B1o.exe 4092 B1o.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 392 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
B1o.execmmon32.exepid process 4092 B1o.exe 4092 B1o.exe 4092 B1o.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe 2924 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
WerFault.exeB1o.execmmon32.exeExplorer.EXEdescription pid process Token: SeRestorePrivilege 3116 WerFault.exe Token: SeBackupPrivilege 3116 WerFault.exe Token: SeDebugPrivilege 3116 WerFault.exe Token: SeDebugPrivilege 4092 B1o.exe Token: SeDebugPrivilege 2924 cmmon32.exe Token: SeShutdownPrivilege 392 Explorer.EXE Token: SeCreatePagefilePrivilege 392 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
B1o.exeExplorer.EXEcmmon32.exedescription pid process target process PID 2404 wrote to memory of 4092 2404 B1o.exe B1o.exe PID 2404 wrote to memory of 4092 2404 B1o.exe B1o.exe PID 2404 wrote to memory of 4092 2404 B1o.exe B1o.exe PID 2404 wrote to memory of 4092 2404 B1o.exe B1o.exe PID 2404 wrote to memory of 4092 2404 B1o.exe B1o.exe PID 2404 wrote to memory of 4092 2404 B1o.exe B1o.exe PID 392 wrote to memory of 2924 392 Explorer.EXE cmmon32.exe PID 392 wrote to memory of 2924 392 Explorer.EXE cmmon32.exe PID 392 wrote to memory of 2924 392 Explorer.EXE cmmon32.exe PID 2924 wrote to memory of 3960 2924 cmmon32.exe cmd.exe PID 2924 wrote to memory of 3960 2924 cmmon32.exe cmd.exe PID 2924 wrote to memory of 3960 2924 cmmon32.exe cmd.exe PID 2924 wrote to memory of 3616 2924 cmmon32.exe Firefox.exe PID 2924 wrote to memory of 3616 2924 cmmon32.exe Firefox.exe PID 2924 wrote to memory of 3616 2924 cmmon32.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\B1o.exe"C:\Users\Admin\AppData\Local\Temp\B1o.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 13123⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\B1o.exe"C:\Users\Admin\AppData\Local\Temp\B1o.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1MD5
b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
memory/392-121-0x0000000005F40000-0x0000000006079000-memory.dmpFilesize
1.2MB
-
memory/392-127-0x0000000004C50000-0x0000000004DC1000-memory.dmpFilesize
1.4MB
-
memory/2404-115-0x0000000000730000-0x0000000000731000-memory.dmpFilesize
4KB
-
memory/2924-122-0x0000000000000000-mapping.dmp
-
memory/2924-123-0x00000000008C0000-0x00000000008CC000-memory.dmpFilesize
48KB
-
memory/2924-124-0x0000000002B50000-0x0000000002B78000-memory.dmpFilesize
160KB
-
memory/2924-125-0x0000000004B30000-0x0000000004E50000-memory.dmpFilesize
3.1MB
-
memory/2924-126-0x00000000049A0000-0x0000000004A2F000-memory.dmpFilesize
572KB
-
memory/3616-131-0x00007FF61EB40000-0x00007FF61EBD3000-memory.dmpFilesize
588KB
-
memory/3616-132-0x000001FA720D0000-0x000001FA721CE000-memory.dmpFilesize
1016KB
-
memory/3616-130-0x0000000000000000-mapping.dmp
-
memory/3960-128-0x0000000000000000-mapping.dmp
-
memory/4092-120-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/4092-119-0x0000000000B30000-0x0000000000E50000-memory.dmpFilesize
3.1MB
-
memory/4092-118-0x000000000041D030-mapping.dmp
-
memory/4092-116-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB