Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
19-11-2021 17:58
Static task
static1
Behavioral task
behavioral1
Sample
U prilogu je izvod racuna.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
U prilogu je izvod racuna.exe
Resource
win10-en-20211104
General
-
Target
U prilogu je izvod racuna.exe
-
Size
897KB
-
MD5
bf7656bd12573a9614800c04bc060b64
-
SHA1
cc38679d954c885e0e5417b8945ee3eceb05746c
-
SHA256
615e6f18d8843af256c4acca22d337f41c24795147dc7329968884a5e42caa10
-
SHA512
bf7e3a3e1f142a4371172c0e2c2671439bf4773b824247d70ddca05364f54b86b43faac2c78e356b53e3b4ce50b13c52d253833ea518519eb68a055416666fe0
Malware Config
Extracted
xloader
2.5
pvxz
http://www.finetipster.com/pvxz/
imt-token.club
abravewayocen.online
shcloudcar.com
mshoppingworld.online
ncgf08.xyz
stuinfo.xyz
wesavetheplanetofficial.com
tourbox.xyz
believeinyourselftraining.com
jsboyat.com
aaeconomy.info
9etmorea.info
purosepeti7.com
goticketly.com
pinkmemorypt.com
mylifewellnesscentre.com
iridina.online
petrestore.online
neema.xyz
novelfooditalia.com
enterprisedaas.computer
tzkaxh.com
brainfarter.com
youniquegal.com
piiqrio.com
mdaszb.com
boldmale.com
era636.com
castleinsuranceco.com
woodennickelmusicfortwayne.com
customer-servis-kredivo.com
high-clicks.com
greetwithgadgets.com
hfsd1.com
insureagainstearthquakes.net
ultimatejump.rest
parivartanyogeshstore.com
handmanagementblog.com
meishangtianhua.com
michaelscottinsurance.net
kershoes.com
atomiccharmworks.com
conciergecompare.com
zeal-hashima.com
coachianscott.com
hwkm.net
019skz.xyz
jardingenesis.com
sumikkoremon.com
tjpengyun.com
sectionpor.xyz
46t.xyz
sa-pontianak.com
localproperty.team
dotexposed.com
cis136-tgarza.com
eiestilo.com
youknowhowtolive.com
phalcosnusa.com
qaticv93iy.com
hbjngs.com
ocean-nettoyage.com
jenuwinclothes.net
anadoluatvoffroad.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3976-120-0x0000000000000000-mapping.dmp xloader behavioral2/memory/3976-122-0x0000000072480000-0x00000000724A9000-memory.dmp xloader behavioral2/memory/2096-130-0x0000000002480000-0x00000000024A9000-memory.dmp xloader -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
U prilogu je izvod racuna.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Run\Qbuxleuj = "C:\\Users\\Public\\Libraries\\Qbuxleuj\\juelxubQ.url" U prilogu je izvod racuna.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
U prilogu je izvod racuna.exedescription ioc process File opened (read-only) \??\A: U prilogu je izvod racuna.exe File opened (read-only) \??\P: U prilogu je izvod racuna.exe File opened (read-only) \??\X: U prilogu je izvod racuna.exe File opened (read-only) \??\Y: U prilogu je izvod racuna.exe File opened (read-only) \??\R: U prilogu je izvod racuna.exe File opened (read-only) \??\B: U prilogu je izvod racuna.exe File opened (read-only) \??\F: U prilogu je izvod racuna.exe File opened (read-only) \??\I: U prilogu je izvod racuna.exe File opened (read-only) \??\K: U prilogu je izvod racuna.exe File opened (read-only) \??\M: U prilogu je izvod racuna.exe File opened (read-only) \??\O: U prilogu je izvod racuna.exe File opened (read-only) \??\Q: U prilogu je izvod racuna.exe File opened (read-only) \??\T: U prilogu je izvod racuna.exe File opened (read-only) \??\U: U prilogu je izvod racuna.exe File opened (read-only) \??\G: U prilogu je izvod racuna.exe File opened (read-only) \??\H: U prilogu je izvod racuna.exe File opened (read-only) \??\V: U prilogu je izvod racuna.exe File opened (read-only) \??\E: U prilogu je izvod racuna.exe File opened (read-only) \??\J: U prilogu je izvod racuna.exe File opened (read-only) \??\L: U prilogu je izvod racuna.exe File opened (read-only) \??\N: U prilogu je izvod racuna.exe File opened (read-only) \??\S: U prilogu je izvod racuna.exe File opened (read-only) \??\W: U prilogu je izvod racuna.exe File opened (read-only) \??\Z: U prilogu je izvod racuna.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
mobsync.exeraserver.exedescription pid process target process PID 3976 set thread context of 3056 3976 mobsync.exe Explorer.EXE PID 2096 set thread context of 3056 2096 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
mobsync.exeraserver.exepid process 3976 mobsync.exe 3976 mobsync.exe 3976 mobsync.exe 3976 mobsync.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe 2096 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3056 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
mobsync.exeraserver.exepid process 3976 mobsync.exe 3976 mobsync.exe 3976 mobsync.exe 2096 raserver.exe 2096 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
mobsync.exeraserver.exedescription pid process Token: SeDebugPrivilege 3976 mobsync.exe Token: SeDebugPrivilege 2096 raserver.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
U prilogu je izvod racuna.exeExplorer.EXEraserver.exedescription pid process target process PID 3068 wrote to memory of 3976 3068 U prilogu je izvod racuna.exe mobsync.exe PID 3068 wrote to memory of 3976 3068 U prilogu je izvod racuna.exe mobsync.exe PID 3068 wrote to memory of 3976 3068 U prilogu je izvod racuna.exe mobsync.exe PID 3068 wrote to memory of 3976 3068 U prilogu je izvod racuna.exe mobsync.exe PID 3068 wrote to memory of 3976 3068 U prilogu je izvod racuna.exe mobsync.exe PID 3068 wrote to memory of 3976 3068 U prilogu je izvod racuna.exe mobsync.exe PID 3056 wrote to memory of 2096 3056 Explorer.EXE raserver.exe PID 3056 wrote to memory of 2096 3056 Explorer.EXE raserver.exe PID 3056 wrote to memory of 2096 3056 Explorer.EXE raserver.exe PID 2096 wrote to memory of 3588 2096 raserver.exe cmd.exe PID 2096 wrote to memory of 3588 2096 raserver.exe cmd.exe PID 2096 wrote to memory of 3588 2096 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\U prilogu je izvod racuna.exe"C:\Users\Admin\AppData\Local\Temp\U prilogu je izvod racuna.exe"2⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mobsync.exeC:\Windows\System32\mobsync.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\mobsync.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2096-129-0x0000000000170000-0x000000000018F000-memory.dmpFilesize
124KB
-
memory/2096-132-0x00000000041F0000-0x0000000004280000-memory.dmpFilesize
576KB
-
memory/2096-131-0x0000000004340000-0x0000000004660000-memory.dmpFilesize
3.1MB
-
memory/2096-130-0x0000000002480000-0x00000000024A9000-memory.dmpFilesize
164KB
-
memory/2096-127-0x0000000000000000-mapping.dmp
-
memory/3056-133-0x0000000005D40000-0x0000000005EAB000-memory.dmpFilesize
1.4MB
-
memory/3056-126-0x00000000025B0000-0x0000000002681000-memory.dmpFilesize
836KB
-
memory/3068-119-0x00000000022F1000-0x0000000002305000-memory.dmpFilesize
80KB
-
memory/3068-118-0x0000000000560000-0x00000000006AA000-memory.dmpFilesize
1.3MB
-
memory/3588-128-0x0000000000000000-mapping.dmp
-
memory/3976-122-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/3976-125-0x0000000001140000-0x0000000001151000-memory.dmpFilesize
68KB
-
memory/3976-124-0x0000000004650000-0x0000000004970000-memory.dmpFilesize
3.1MB
-
memory/3976-121-0x0000000000E90000-0x0000000000E91000-memory.dmpFilesize
4KB
-
memory/3976-120-0x0000000000000000-mapping.dmp