Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
20-10-2021 05:37
Static task
static1
Behavioral task
behavioral1
Sample
Drawing.exe
Resource
win7-en-20211014
General
-
Target
Drawing.exe
-
Size
572KB
-
MD5
da60dccf62e5dd00e76531b6e0e74794
-
SHA1
a9bb11bbb6bcc1cb69b302bcec25ec29d770e6d4
-
SHA256
88f9f44e6cb13da79a3967ffa56a9d8c46d8d49623518df5e90c3d4cf72b3b79
-
SHA512
e6e25dbcc0b8669f781da4533783f5cf9abb568762837c03768369b4b9d99e4b637ff1a06f1829d53b683e2dc2ade14831bc5df804e42d2516f9ed96e6f6a74f
Malware Config
Extracted
xloader
2.5
dq6e
http://www.nihiufypsz.quest/dq6e/
one80.center
buymorefun.store
wiew-bkjm.com
elvalordesertu.com
tallyeyeglassery.net
nuhive.net
supportsmercari.com
h5625.com
dfgroup.website
personlig-almanacka.com
gunpow3r.com
xn--tiergesttzt-0hb.com
mpochip.com
accreditslots.com
gameplancyber.com
clickonline.website
bhagyashreerestaurant.com
lunaenglish.online
kidsorange.com
reshapers.art
19hawthornedrive166.com
allisonholaday.com
tuner-buy.com
lehyeh.com
salonspasuitesmanamgement.com
gordianits.com
zhuoyu168.com
jokeaou.com
tous-des-cons.club
ilmn8.com
geetamalhotra.com
crescentiron.com
therecipe.store
teneses.com
liberbankrtes.com
lifechangingcarehouston.com
balanz.express
poizboutique.com
anblogsite.com
chicherone.com
rotibagelen.com
trendystoreonline2021.com
boudoirluxe.com
grandhoums.com
oneloyalty.online
ospreyoutlet.store
xn--hc0bm0v0zb40ifs0a.com
localizandolab.com
mmorpgheroes.net
bodies-gym.xyz
thenorthdale.com
lasikeyesurgerysclinicus.com
pwntheusa.com
eaiworwek.xyz
almatnstore.com
savandehop.com
primetire.net
d-destiny.com
delmarexclusive.com
magentasrc.com
3danimation.xyz
getjano.com
cakeriver.com
wazis.store
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/912-119-0x0000000000401000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2904-125-0x0000000002B80000-0x0000000002BA9000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Drawing.exeDrawing.execscript.exedescription pid process target process PID 1892 set thread context of 912 1892 Drawing.exe Drawing.exe PID 912 set thread context of 2872 912 Drawing.exe Explorer.EXE PID 912 set thread context of 2872 912 Drawing.exe Explorer.EXE PID 2904 set thread context of 2872 2904 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
Drawing.execscript.exepid process 912 Drawing.exe 912 Drawing.exe 912 Drawing.exe 912 Drawing.exe 912 Drawing.exe 912 Drawing.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe 2904 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2872 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Drawing.execscript.exepid process 912 Drawing.exe 912 Drawing.exe 912 Drawing.exe 912 Drawing.exe 2904 cscript.exe 2904 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Drawing.execscript.exedescription pid process Token: SeDebugPrivilege 912 Drawing.exe Token: SeDebugPrivilege 2904 cscript.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Drawing.exepid process 1892 Drawing.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Drawing.exeExplorer.EXEcscript.exedescription pid process target process PID 1892 wrote to memory of 912 1892 Drawing.exe Drawing.exe PID 1892 wrote to memory of 912 1892 Drawing.exe Drawing.exe PID 1892 wrote to memory of 912 1892 Drawing.exe Drawing.exe PID 1892 wrote to memory of 912 1892 Drawing.exe Drawing.exe PID 2872 wrote to memory of 2904 2872 Explorer.EXE cscript.exe PID 2872 wrote to memory of 2904 2872 Explorer.EXE cscript.exe PID 2872 wrote to memory of 2904 2872 Explorer.EXE cscript.exe PID 2904 wrote to memory of 2808 2904 cscript.exe cmd.exe PID 2904 wrote to memory of 2808 2904 cscript.exe cmd.exe PID 2904 wrote to memory of 2808 2904 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Drawing.exe"C:\Users\Admin\AppData\Local\Temp\Drawing.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Drawing.exe"C:\Users\Admin\AppData\Local\Temp\Drawing.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Drawing.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/912-115-0x000000000041D430-mapping.dmp
-
memory/912-117-0x00000000008C0000-0x00000000008D1000-memory.dmpFilesize
68KB
-
memory/912-116-0x0000000000990000-0x0000000000CB0000-memory.dmpFilesize
3.1MB
-
memory/912-119-0x0000000000401000-0x0000000000429000-memory.dmpFilesize
160KB
-
memory/912-120-0x0000000000910000-0x0000000000921000-memory.dmpFilesize
68KB
-
memory/2808-123-0x0000000000000000-mapping.dmp
-
memory/2872-121-0x00000000023F0000-0x00000000024EE000-memory.dmpFilesize
1016KB
-
memory/2872-118-0x0000000005E50000-0x0000000005F5B000-memory.dmpFilesize
1.0MB
-
memory/2872-128-0x0000000004AE0000-0x0000000004BE8000-memory.dmpFilesize
1.0MB
-
memory/2904-122-0x0000000000000000-mapping.dmp
-
memory/2904-125-0x0000000002B80000-0x0000000002BA9000-memory.dmpFilesize
164KB
-
memory/2904-126-0x0000000004E40000-0x0000000005160000-memory.dmpFilesize
3.1MB
-
memory/2904-124-0x0000000000930000-0x0000000000957000-memory.dmpFilesize
156KB
-
memory/2904-127-0x0000000004CA0000-0x0000000004D30000-memory.dmpFilesize
576KB