Analysis
-
max time kernel
148s -
max time network
141s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
26-11-2021 10:27
Static task
static1
Behavioral task
behavioral1
Sample
DO 2168569 2172145000025112021.exe
Resource
win7-en-20211104
General
-
Target
DO 2168569 2172145000025112021.exe
-
Size
584KB
-
MD5
cb8bd5b9563bf3cfbafbbbbf99048266
-
SHA1
9972dd790388aa860598448da56312571e4f4f5e
-
SHA256
16afc1275bbb9dc325bcb03d7d0fb57b704adc0438c5c006070bdd07f2259230
-
SHA512
858f481523f80cd8490deb9539a4ca8d5109aba5c6328ad0ea6f7aa063c229c462bc3a19197b08c7e6811df41c21b7fe8d7bf27f69a3c93d96f97795a88956a6
Malware Config
Extracted
xloader
2.5
u0n0
http://www.52xjg3.xyz/u0n0/
learnwithvr.net
minismi2.com
slimfitbottle.com
gzartisan.com
fullfamilyclub.com
adaptationstudios.com
domynt.com
aboydnfuid.com
dirtroaddesigns.net
timhortons-ca.xyz
gladiator-111.com
breakingza.com
njjbds.com
keithrgordon.com
litestore365.host
unichromegame.com
wundversorgung-tirol.com
wholistic-choice.com
shingletownrrn.com
kapikenya.com
kermmehienon.quest
harunowellness.com
avrknastyrke.quest
mpujadas.com
bonbyk.xyz
twozilla.com
abrahamguestacademy.com
canwasysce.com
cangshu76.xyz
clinicadeconsultanta.com
fazdesignmalta.com
localcommunityspace.com
subdlt.com
gothambody.net
tongtongticket.com
giadinhmarket.xyz
jessaniholdings.com
sebika.com
infinitygamesonline.net
denton4.com
ctenemuhos.quest
governerdsummerfun.com
69988.club
2pnlx3.biz
radhikamobilerajasen.online
myborntoshare.com
mdkfsdf.info
dj6688a.com
feelinthorny.com
minimart.digital
offprize.xyz
niallsinclair.com
iclouds.today
xn--80ajy8a.xn--80asehdb
marionutrishop.com
yanglaowenku.com
youngmotorist.com
unavidaparaserfeliz.com
linknhomkin.com
webwarez.net
sabrinaxmendes.com
nurix.agency
bancosabadellnow.com
totalpopsociety.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1580-127-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1580-128-0x000000000041D440-mapping.dmp xloader behavioral2/memory/3488-136-0x0000000000720000-0x0000000000749000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
DO 2168569 2172145000025112021.exeDO 2168569 2172145000025112021.exehelp.exedescription pid process target process PID 2704 set thread context of 1580 2704 DO 2168569 2172145000025112021.exe DO 2168569 2172145000025112021.exe PID 1580 set thread context of 3020 1580 DO 2168569 2172145000025112021.exe Explorer.EXE PID 3488 set thread context of 3020 3488 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
DO 2168569 2172145000025112021.exehelp.exepid process 1580 DO 2168569 2172145000025112021.exe 1580 DO 2168569 2172145000025112021.exe 1580 DO 2168569 2172145000025112021.exe 1580 DO 2168569 2172145000025112021.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe 3488 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
DO 2168569 2172145000025112021.exehelp.exepid process 1580 DO 2168569 2172145000025112021.exe 1580 DO 2168569 2172145000025112021.exe 1580 DO 2168569 2172145000025112021.exe 3488 help.exe 3488 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
DO 2168569 2172145000025112021.exehelp.exedescription pid process Token: SeDebugPrivilege 1580 DO 2168569 2172145000025112021.exe Token: SeDebugPrivilege 3488 help.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
DO 2168569 2172145000025112021.exeExplorer.EXEhelp.exedescription pid process target process PID 2704 wrote to memory of 1580 2704 DO 2168569 2172145000025112021.exe DO 2168569 2172145000025112021.exe PID 2704 wrote to memory of 1580 2704 DO 2168569 2172145000025112021.exe DO 2168569 2172145000025112021.exe PID 2704 wrote to memory of 1580 2704 DO 2168569 2172145000025112021.exe DO 2168569 2172145000025112021.exe PID 2704 wrote to memory of 1580 2704 DO 2168569 2172145000025112021.exe DO 2168569 2172145000025112021.exe PID 2704 wrote to memory of 1580 2704 DO 2168569 2172145000025112021.exe DO 2168569 2172145000025112021.exe PID 2704 wrote to memory of 1580 2704 DO 2168569 2172145000025112021.exe DO 2168569 2172145000025112021.exe PID 3020 wrote to memory of 3488 3020 Explorer.EXE help.exe PID 3020 wrote to memory of 3488 3020 Explorer.EXE help.exe PID 3020 wrote to memory of 3488 3020 Explorer.EXE help.exe PID 3488 wrote to memory of 3240 3488 help.exe cmd.exe PID 3488 wrote to memory of 3240 3488 help.exe cmd.exe PID 3488 wrote to memory of 3240 3488 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DO 2168569 2172145000025112021.exe"C:\Users\Admin\AppData\Local\Temp\DO 2168569 2172145000025112021.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DO 2168569 2172145000025112021.exe"C:\Users\Admin\AppData\Local\Temp\DO 2168569 2172145000025112021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DO 2168569 2172145000025112021.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1580-127-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1580-130-0x0000000001570000-0x0000000001890000-memory.dmpFilesize
3.1MB
-
memory/1580-131-0x0000000000FB0000-0x00000000010FA000-memory.dmpFilesize
1.3MB
-
memory/1580-128-0x000000000041D440-mapping.dmp
-
memory/2704-126-0x0000000006170000-0x0000000006171000-memory.dmpFilesize
4KB
-
memory/2704-118-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/2704-122-0x00000000056C0000-0x00000000056C8000-memory.dmpFilesize
32KB
-
memory/2704-123-0x00000000056E0000-0x00000000056E1000-memory.dmpFilesize
4KB
-
memory/2704-124-0x0000000005A70000-0x0000000005A71000-memory.dmpFilesize
4KB
-
memory/2704-125-0x0000000005C10000-0x0000000005C6A000-memory.dmpFilesize
360KB
-
memory/2704-115-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB
-
memory/2704-120-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/2704-119-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/2704-121-0x0000000000983000-0x0000000000985000-memory.dmpFilesize
8KB
-
memory/2704-117-0x0000000000980000-0x0000000000981000-memory.dmpFilesize
4KB
-
memory/3020-132-0x0000000005F40000-0x00000000060C0000-memory.dmpFilesize
1.5MB
-
memory/3020-139-0x0000000002710000-0x00000000027E7000-memory.dmpFilesize
860KB
-
memory/3240-134-0x0000000000000000-mapping.dmp
-
memory/3488-133-0x0000000000000000-mapping.dmp
-
memory/3488-136-0x0000000000720000-0x0000000000749000-memory.dmpFilesize
164KB
-
memory/3488-135-0x0000000000830000-0x0000000000837000-memory.dmpFilesize
28KB
-
memory/3488-137-0x0000000003220000-0x0000000003540000-memory.dmpFilesize
3.1MB
-
memory/3488-138-0x0000000002E70000-0x0000000002F00000-memory.dmpFilesize
576KB