Analysis
-
max time kernel
148s -
max time network
131s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
24-09-2021 11:21
Static task
static1
Behavioral task
behavioral1
Sample
GLEASON_QT2309.exe
Resource
win7-en-20210920
General
-
Target
GLEASON_QT2309.exe
-
Size
642KB
-
MD5
d601604552146dd9a412f1db8ff0cdd4
-
SHA1
8dc649c53d100c5d1f1330dc5ba33c680208d7f8
-
SHA256
3121d773a680fbac7dc37f75c38ae8ef20f1b88915cc0b83ca9bf2bf7c22ee94
-
SHA512
ae739f1a3ec1b0890dfc46a2b5d88e8cf211ecbc462539a1878e25c33c081ada166d1ad09bf859dd8e83f246d73b7bc9cf5c9f75465be7b09b0566aae50ebc34
Malware Config
Extracted
xloader
2.5
g9vg
http://www.supra413.com/g9vg/
selenebrennan.com
htsfrance.com
monsieurtechno.com
argosy.city
lit-clouds.com
emilio-m.com
crashycraft.net
washmebro.com
1houroflife.com
millershaga.com
newtonpod.com
camopants.net
animator-show.com
qqzome.com
assetacre.com
letsmakeyourchoice.com
gileadpreferences.com
ecomarklifestyle.com
mivaautomotive.com
rattle100.com
askfortesting.com
majorelectricalwork.com
blockbotprofit.com
lanceseuexpert.online
zatventure.com
fitnessbykc.com
renatafaceandbodyskincare.com
opusmime.com
biyimeilou.com
soulhospitalitygroup.net
peaktradecapital.com
augmentedfact.com
petmall.website
rfmanutencoes.com
mgav40.xyz
konzertmanagement.com
thisisweenz.com
xn--42cg2czax6ptae6a.com
scienceworldapub.com
perfumeriavictory.com
ankarasinirsizescortlar.xyz
keenflat.com
fodfus.com
bright-tailor.com
spaciolb.com
pinkpolishseattle.com
homewebmailz.com
devple.com
cimehey9.xyz
tracks-clicks.com
xn--vcs93h35hgx1d.com
omightygod.com
francesmaydesign.com
partyitemshire.com
alsatkazan.com
thewhitfieldcondos.info
kevin-kwan.com
amazoncosmo.site
gamasecjapan.com
softwarenews.digital
cakeboxjamaica.com
vitale.global
bonvivanto.com
amazingsiddha.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/964-60-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/964-61-0x000000000041D450-mapping.dmp xloader behavioral1/memory/960-69-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 268 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
GLEASON_QT2309.exeGLEASON_QT2309.exechkdsk.exedescription pid process target process PID 1324 set thread context of 964 1324 GLEASON_QT2309.exe GLEASON_QT2309.exe PID 964 set thread context of 1244 964 GLEASON_QT2309.exe Explorer.EXE PID 964 set thread context of 1244 964 GLEASON_QT2309.exe Explorer.EXE PID 960 set thread context of 1244 960 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
GLEASON_QT2309.exechkdsk.exepid process 964 GLEASON_QT2309.exe 964 GLEASON_QT2309.exe 964 GLEASON_QT2309.exe 960 chkdsk.exe 960 chkdsk.exe 960 chkdsk.exe 960 chkdsk.exe 960 chkdsk.exe 960 chkdsk.exe 960 chkdsk.exe 960 chkdsk.exe 960 chkdsk.exe 960 chkdsk.exe 960 chkdsk.exe 960 chkdsk.exe 960 chkdsk.exe 960 chkdsk.exe 960 chkdsk.exe 960 chkdsk.exe 960 chkdsk.exe 960 chkdsk.exe 960 chkdsk.exe 960 chkdsk.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
GLEASON_QT2309.exechkdsk.exepid process 964 GLEASON_QT2309.exe 964 GLEASON_QT2309.exe 964 GLEASON_QT2309.exe 964 GLEASON_QT2309.exe 960 chkdsk.exe 960 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
GLEASON_QT2309.exechkdsk.exedescription pid process Token: SeDebugPrivilege 964 GLEASON_QT2309.exe Token: SeDebugPrivilege 960 chkdsk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
GLEASON_QT2309.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1324 wrote to memory of 964 1324 GLEASON_QT2309.exe GLEASON_QT2309.exe PID 1324 wrote to memory of 964 1324 GLEASON_QT2309.exe GLEASON_QT2309.exe PID 1324 wrote to memory of 964 1324 GLEASON_QT2309.exe GLEASON_QT2309.exe PID 1324 wrote to memory of 964 1324 GLEASON_QT2309.exe GLEASON_QT2309.exe PID 1324 wrote to memory of 964 1324 GLEASON_QT2309.exe GLEASON_QT2309.exe PID 1324 wrote to memory of 964 1324 GLEASON_QT2309.exe GLEASON_QT2309.exe PID 1324 wrote to memory of 964 1324 GLEASON_QT2309.exe GLEASON_QT2309.exe PID 1244 wrote to memory of 960 1244 Explorer.EXE chkdsk.exe PID 1244 wrote to memory of 960 1244 Explorer.EXE chkdsk.exe PID 1244 wrote to memory of 960 1244 Explorer.EXE chkdsk.exe PID 1244 wrote to memory of 960 1244 Explorer.EXE chkdsk.exe PID 960 wrote to memory of 268 960 chkdsk.exe cmd.exe PID 960 wrote to memory of 268 960 chkdsk.exe cmd.exe PID 960 wrote to memory of 268 960 chkdsk.exe cmd.exe PID 960 wrote to memory of 268 960 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GLEASON_QT2309.exe"C:\Users\Admin\AppData\Local\Temp\GLEASON_QT2309.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GLEASON_QT2309.exe"C:\Users\Admin\AppData\Local\Temp\GLEASON_QT2309.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\GLEASON_QT2309.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-70-0x0000000000000000-mapping.dmp
-
memory/960-67-0x0000000000000000-mapping.dmp
-
memory/960-72-0x0000000002270000-0x0000000002300000-memory.dmpFilesize
576KB
-
memory/960-71-0x0000000001F60000-0x0000000002263000-memory.dmpFilesize
3.0MB
-
memory/960-69-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/960-68-0x00000000006F0000-0x00000000006F7000-memory.dmpFilesize
28KB
-
memory/964-62-0x0000000000930000-0x0000000000C33000-memory.dmpFilesize
3.0MB
-
memory/964-63-0x0000000000290000-0x00000000002A1000-memory.dmpFilesize
68KB
-
memory/964-65-0x00000000002D0000-0x00000000002E1000-memory.dmpFilesize
68KB
-
memory/964-61-0x000000000041D450-mapping.dmp
-
memory/964-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1244-64-0x00000000061A0000-0x00000000062BB000-memory.dmpFilesize
1.1MB
-
memory/1244-66-0x0000000006010000-0x0000000006115000-memory.dmpFilesize
1.0MB
-
memory/1244-73-0x00000000062C0000-0x0000000006396000-memory.dmpFilesize
856KB
-
memory/1324-54-0x0000000001220000-0x0000000001221000-memory.dmpFilesize
4KB
-
memory/1324-59-0x0000000000BA0000-0x0000000000BD7000-memory.dmpFilesize
220KB
-
memory/1324-58-0x0000000004FA0000-0x0000000005006000-memory.dmpFilesize
408KB
-
memory/1324-57-0x00000000002D0000-0x00000000002ED000-memory.dmpFilesize
116KB
-
memory/1324-56-0x0000000000A20000-0x0000000000A21000-memory.dmpFilesize
4KB