Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
20-10-2021 22:49
Static task
static1
Behavioral task
behavioral1
Sample
F30AGnBthja6Ka2.exe
Resource
win7-en-20210920
General
-
Target
F30AGnBthja6Ka2.exe
-
Size
369KB
-
MD5
dfc50ba1caa7b380c83943554b211e37
-
SHA1
e1cf4a47da954565762310d856d9454ac6fdf1ce
-
SHA256
dd8fdaec54b12c6195b23601689139226a7500fefbf665b1eb3cf9df3358da5a
-
SHA512
8f2567adf691fff0820df3d5c595a58b00ad02e154cef5065845ad2c58900b92618fc8a2da5994144f9d5535abfc8e3eeba6cf3d4fa76ad1fa4737e24eb29887
Malware Config
Extracted
xloader
2.5
n35q
http://www.24hr.online/n35q/
franamunneth.com
lattent.digital
sharynpre.com
recupcolis.com
centraliahome.com
funteefactory.com
acconyschool.com
melissapourturk.com
greenteamunderground.com
ord2route.art
seunicapf.com
sun-8888.com
mountlaketerraceapartment.com
themtop.club
32342230.xyz
starnesportfolio.com
samarpankota.com
diversifiedcontractingla.com
qhrubber.com
bobbelloc.top
ofertastododiaa.com
thegreatkitchen.com
dvsagenciadigital.com
coxmediahamptonroads.com
treeservice-estimate.com
uncoverthesecrets.com
eafd.online
riddleme.one
khadmeh.com
the4asofdekhockey.com
zhimapaike.com
moukse.com
photo.fail
thekurent.net
pariyattidham.com
everhunttransportation.com
livingdeadgrl.net
marskidscollection.com
lovelessneilsen.online
philsinvest.com
elretratodetualma.com
solanaforge.art
adlove69.com
i8news-at.website
goddarddrillingllc.com
grantopwincup.website
ai-technology-online-ru.space
wns12688.com
prazeresconstrucoes.com
hariribiolab.com
dymends.digital
evendatazambia.com
modesmalo.quest
yoshinew.com
friendsofparkcityeducation.com
coyotesmoving.com
healthcareers.info
lm-safe-keepingtoyof4.xyz
dentalpnid.com
lakelandranch.com
cardealsukorg.com
aheadinstyle.club
thompsonbi.com
chicagoredtailedhawks.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2136-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2136-125-0x000000000041D490-mapping.dmp xloader behavioral2/memory/1128-132-0x0000000000C80000-0x0000000000CA9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
F30AGnBthja6Ka2.exeF30AGnBthja6Ka2.exeipconfig.exedescription pid process target process PID 1836 set thread context of 2136 1836 F30AGnBthja6Ka2.exe F30AGnBthja6Ka2.exe PID 2136 set thread context of 3028 2136 F30AGnBthja6Ka2.exe Explorer.EXE PID 1128 set thread context of 3028 1128 ipconfig.exe Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1128 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
F30AGnBthja6Ka2.exeipconfig.exepid process 2136 F30AGnBthja6Ka2.exe 2136 F30AGnBthja6Ka2.exe 2136 F30AGnBthja6Ka2.exe 2136 F30AGnBthja6Ka2.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe 1128 ipconfig.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3028 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
F30AGnBthja6Ka2.exeipconfig.exepid process 2136 F30AGnBthja6Ka2.exe 2136 F30AGnBthja6Ka2.exe 2136 F30AGnBthja6Ka2.exe 1128 ipconfig.exe 1128 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
F30AGnBthja6Ka2.exeipconfig.exedescription pid process Token: SeDebugPrivilege 2136 F30AGnBthja6Ka2.exe Token: SeDebugPrivilege 1128 ipconfig.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
F30AGnBthja6Ka2.exeExplorer.EXEipconfig.exedescription pid process target process PID 1836 wrote to memory of 2136 1836 F30AGnBthja6Ka2.exe F30AGnBthja6Ka2.exe PID 1836 wrote to memory of 2136 1836 F30AGnBthja6Ka2.exe F30AGnBthja6Ka2.exe PID 1836 wrote to memory of 2136 1836 F30AGnBthja6Ka2.exe F30AGnBthja6Ka2.exe PID 1836 wrote to memory of 2136 1836 F30AGnBthja6Ka2.exe F30AGnBthja6Ka2.exe PID 1836 wrote to memory of 2136 1836 F30AGnBthja6Ka2.exe F30AGnBthja6Ka2.exe PID 1836 wrote to memory of 2136 1836 F30AGnBthja6Ka2.exe F30AGnBthja6Ka2.exe PID 3028 wrote to memory of 1128 3028 Explorer.EXE ipconfig.exe PID 3028 wrote to memory of 1128 3028 Explorer.EXE ipconfig.exe PID 3028 wrote to memory of 1128 3028 Explorer.EXE ipconfig.exe PID 1128 wrote to memory of 1612 1128 ipconfig.exe cmd.exe PID 1128 wrote to memory of 1612 1128 ipconfig.exe cmd.exe PID 1128 wrote to memory of 1612 1128 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F30AGnBthja6Ka2.exe"C:\Users\Admin\AppData\Local\Temp\F30AGnBthja6Ka2.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F30AGnBthja6Ka2.exe"C:\Users\Admin\AppData\Local\Temp\F30AGnBthja6Ka2.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\F30AGnBthja6Ka2.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1128-130-0x0000000000000000-mapping.dmp
-
memory/1128-135-0x00000000032C0000-0x0000000003350000-memory.dmpFilesize
576KB
-
memory/1128-132-0x0000000000C80000-0x0000000000CA9000-memory.dmpFilesize
164KB
-
memory/1128-133-0x00000000034A0000-0x00000000037C0000-memory.dmpFilesize
3.1MB
-
memory/1128-131-0x00000000012B0000-0x00000000012BB000-memory.dmpFilesize
44KB
-
memory/1612-134-0x0000000000000000-mapping.dmp
-
memory/1836-121-0x0000000005420000-0x0000000005427000-memory.dmpFilesize
28KB
-
memory/1836-119-0x0000000005230000-0x000000000572E000-memory.dmpFilesize
5.0MB
-
memory/1836-117-0x0000000005730000-0x0000000005731000-memory.dmpFilesize
4KB
-
memory/1836-118-0x0000000005230000-0x0000000005231000-memory.dmpFilesize
4KB
-
memory/1836-123-0x0000000005FB0000-0x0000000005FFB000-memory.dmpFilesize
300KB
-
memory/1836-120-0x00000000051A0000-0x00000000051A1000-memory.dmpFilesize
4KB
-
memory/1836-115-0x0000000000900000-0x0000000000901000-memory.dmpFilesize
4KB
-
memory/1836-122-0x0000000005F10000-0x0000000005F11000-memory.dmpFilesize
4KB
-
memory/2136-127-0x0000000001990000-0x0000000001CB0000-memory.dmpFilesize
3.1MB
-
memory/2136-128-0x00000000018E0000-0x00000000018F1000-memory.dmpFilesize
68KB
-
memory/2136-125-0x000000000041D490-mapping.dmp
-
memory/2136-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3028-129-0x0000000006100000-0x0000000006258000-memory.dmpFilesize
1.3MB
-
memory/3028-136-0x0000000006300000-0x0000000006474000-memory.dmpFilesize
1.5MB