Analysis
-
max time kernel
298s -
max time network
282s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
27-09-2021 04:09
Static task
static1
Behavioral task
behavioral1
Sample
$$$.exe
Resource
win7-en-20210920
General
-
Target
$$$.exe
-
Size
761KB
-
MD5
2d4991b52cb7c3f5e3cb8ed4d22c069a
-
SHA1
5f16af33b1cc461e4c6b4f5d1848547040fa1772
-
SHA256
984dec79b881adf59d5308f52fddeda0fbccbd917b750f6ec9a5be1a1a4dc0fa
-
SHA512
ee17ff87e053092385d90337cbab6719822f137dbf33408f10dc52f4c0db2579f54d56d54be7e55439945705de9005c27e361c29909d05704339c5333a8b14a2
Malware Config
Extracted
xloader
2.5
jdt0
http://www.jen4x.com/jdt0/
william188.com
kmknim.com
freedomnofear.com
industrialohare.com
devopswave.com
g1fz.com
aliceguidi.info
linkared.com
crossboda.com
lpddr3.com
ktnword.xyz
productsdesign.top
dulichnhatviet.com
piazzaassociates.com
inpude.com
kmi.contractors
getkyrobak.com
sportinggoodssuperstore.com
trifoly.info
aspectjudge.com
yangmoo.com
shiftmedicalstaffing.agency
umofan.com
investmentqualityjewels.com
hoteldelpaseocampeche.com
ezhandianfu888.com
liveincare-online.com
riverflowmassage.com
heldyn.com
escueladecampo.com
telecombazaar.com
oshitoishi.net
microexpertise.com
successportal.net
nepll.com
jdqmg.com
aedificeproperty.com
element-light.com
karenellissolutions.com
embutidosdigitales.com
goddistorted.com
wanimi.online
online-ec.biz
staysg.club
roytoys.xyz
loadcenter-dropbox.biz
appcast-70.com
espraycash.com
busizy.com
intellibotz.com
gg-loader.com
rocketdealfinder.com
hosting-premium-online.com
lookyanychev-gallery.store
norllix.com
itooze.com
cbuqn.com
life-lover.com
kelloscosplay.com
memory-information.club
grand-polyana.com
sanieart.com
pavlonmedia.net
edgar-regale.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1492-59-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1492-60-0x000000000041D390-mapping.dmp xloader behavioral1/memory/1448-67-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Executes dropped EXE 1 IoCs
Processes:
Cookies_lr0.exepid process 1400 Cookies_lr0.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
systray.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run systray.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\8PADATQ8FL = "C:\\Program Files (x86)\\Lxtkd\\Cookies_lr0.exe" systray.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
$$$.exeRegSvcs.exesystray.exedescription pid process target process PID 1776 set thread context of 1492 1776 $$$.exe RegSvcs.exe PID 1492 set thread context of 1204 1492 RegSvcs.exe Explorer.EXE PID 1448 set thread context of 1204 1448 systray.exe Explorer.EXE -
Drops file in Program Files directory 2 IoCs
Processes:
systray.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Lxtkd\Cookies_lr0.exe systray.exe File created C:\Program Files (x86)\Lxtkd\Cookies_lr0.exe Explorer.EXE -
Processes:
systray.exedescription ioc process Key created \Registry\User\S-1-5-21-3456797065-1076791440-4146276586-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
Processes:
$$$.exeRegSvcs.exesystray.exepid process 1776 $$$.exe 1776 $$$.exe 1492 RegSvcs.exe 1492 RegSvcs.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
RegSvcs.exesystray.exepid process 1492 RegSvcs.exe 1492 RegSvcs.exe 1492 RegSvcs.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe 1448 systray.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
$$$.exeRegSvcs.exesystray.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1776 $$$.exe Token: SeDebugPrivilege 1492 RegSvcs.exe Token: SeDebugPrivilege 1448 systray.exe Token: SeShutdownPrivilege 1204 Explorer.EXE Token: SeShutdownPrivilege 1204 Explorer.EXE Token: SeShutdownPrivilege 1204 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
$$$.exeExplorer.EXEsystray.exedescription pid process target process PID 1776 wrote to memory of 1492 1776 $$$.exe RegSvcs.exe PID 1776 wrote to memory of 1492 1776 $$$.exe RegSvcs.exe PID 1776 wrote to memory of 1492 1776 $$$.exe RegSvcs.exe PID 1776 wrote to memory of 1492 1776 $$$.exe RegSvcs.exe PID 1776 wrote to memory of 1492 1776 $$$.exe RegSvcs.exe PID 1776 wrote to memory of 1492 1776 $$$.exe RegSvcs.exe PID 1776 wrote to memory of 1492 1776 $$$.exe RegSvcs.exe PID 1776 wrote to memory of 1492 1776 $$$.exe RegSvcs.exe PID 1776 wrote to memory of 1492 1776 $$$.exe RegSvcs.exe PID 1776 wrote to memory of 1492 1776 $$$.exe RegSvcs.exe PID 1204 wrote to memory of 1448 1204 Explorer.EXE systray.exe PID 1204 wrote to memory of 1448 1204 Explorer.EXE systray.exe PID 1204 wrote to memory of 1448 1204 Explorer.EXE systray.exe PID 1204 wrote to memory of 1448 1204 Explorer.EXE systray.exe PID 1448 wrote to memory of 1764 1448 systray.exe cmd.exe PID 1448 wrote to memory of 1764 1448 systray.exe cmd.exe PID 1448 wrote to memory of 1764 1448 systray.exe cmd.exe PID 1448 wrote to memory of 1764 1448 systray.exe cmd.exe PID 1448 wrote to memory of 1488 1448 systray.exe Firefox.exe PID 1448 wrote to memory of 1488 1448 systray.exe Firefox.exe PID 1448 wrote to memory of 1488 1448 systray.exe Firefox.exe PID 1448 wrote to memory of 1488 1448 systray.exe Firefox.exe PID 1204 wrote to memory of 1400 1204 Explorer.EXE Cookies_lr0.exe PID 1204 wrote to memory of 1400 1204 Explorer.EXE Cookies_lr0.exe PID 1204 wrote to memory of 1400 1204 Explorer.EXE Cookies_lr0.exe PID 1204 wrote to memory of 1400 1204 Explorer.EXE Cookies_lr0.exe PID 1204 wrote to memory of 1400 1204 Explorer.EXE Cookies_lr0.exe PID 1204 wrote to memory of 1400 1204 Explorer.EXE Cookies_lr0.exe PID 1204 wrote to memory of 1400 1204 Explorer.EXE Cookies_lr0.exe PID 1448 wrote to memory of 1488 1448 systray.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\$$$.exe"C:\Users\Admin\AppData\Local\Temp\$$$.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Lxtkd\Cookies_lr0.exe"C:\Program Files (x86)\Lxtkd\Cookies_lr0.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Lxtkd\Cookies_lr0.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Program Files (x86)\Lxtkd\Cookies_lr0.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
memory/1204-63-0x0000000004C30000-0x0000000004DB8000-memory.dmpFilesize
1.5MB
-
memory/1204-70-0x0000000004390000-0x00000000044AE000-memory.dmpFilesize
1.1MB
-
memory/1400-76-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB
-
memory/1400-75-0x0000000000DE0000-0x0000000000DE1000-memory.dmpFilesize
4KB
-
memory/1400-72-0x0000000000000000-mapping.dmp
-
memory/1448-66-0x0000000000CC0000-0x0000000000CC5000-memory.dmpFilesize
20KB
-
memory/1448-71-0x0000000076851000-0x0000000076853000-memory.dmpFilesize
8KB
-
memory/1448-69-0x0000000000970000-0x0000000000A00000-memory.dmpFilesize
576KB
-
memory/1448-64-0x0000000000000000-mapping.dmp
-
memory/1448-68-0x00000000020D0000-0x00000000023D3000-memory.dmpFilesize
3.0MB
-
memory/1448-67-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1488-77-0x0000000000000000-mapping.dmp
-
memory/1488-78-0x000000013FB20000-0x000000013FBB3000-memory.dmpFilesize
588KB
-
memory/1488-79-0x0000000002430000-0x000000000258E000-memory.dmpFilesize
1.4MB
-
memory/1492-62-0x0000000000150000-0x0000000000161000-memory.dmpFilesize
68KB
-
memory/1492-61-0x0000000000AA0000-0x0000000000DA3000-memory.dmpFilesize
3.0MB
-
memory/1492-60-0x000000000041D390-mapping.dmp
-
memory/1492-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1764-65-0x0000000000000000-mapping.dmp
-
memory/1776-53-0x0000000001050000-0x0000000001051000-memory.dmpFilesize
4KB
-
memory/1776-55-0x0000000004D70000-0x0000000004D71000-memory.dmpFilesize
4KB
-
memory/1776-56-0x0000000000480000-0x0000000000487000-memory.dmpFilesize
28KB
-
memory/1776-57-0x0000000004BE0000-0x0000000004C3F000-memory.dmpFilesize
380KB
-
memory/1776-58-0x0000000000A70000-0x0000000000A9F000-memory.dmpFilesize
188KB