Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
18-01-2022 16:12
Static task
static1
Behavioral task
behavioral1
Sample
IMG-0046378383.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
IMG-0046378383.exe
Resource
win10v2004-en-20220113
General
-
Target
IMG-0046378383.exe
-
Size
373KB
-
MD5
ababcdf5785412a747d87177b934e515
-
SHA1
5254b6a22dfeb26d9ae987bd19573f213bdf46f2
-
SHA256
fd3c9ec5aa55237cf52aabcee01fe3013d59e59eb6722e80f44aa8ce05ec2e9c
-
SHA512
4fb094cac5ad82549963baac10178475dcb408993c6bfa3b644aeeda6b03ebf4625b952c34070ae170d4ee4d17f363b21980c231d0c53dd16d1ca3a1bdd51e8e
Malware Config
Extracted
xloader
2.5
c6si
tristateinc.construction
americanscaregroundstexas.com
kanimisoshiru.com
wihling.com
fishcheekstosa.com
parentsfuid.com
greenstandmarket.com
fc8fla8kzq.com
gametwist-83.club
jobsncvs.com
directrealtysells.com
avida2015.com
conceptasite.net
arkaneattire.com
indev-mobility.info
2160centurypark412.com
valefloor.com
septembership.com
stackflix.com
jimc0sales.net
socialviralup.com
lastra41.com
juliaepaulovaocasar.com
jurisagora.com
drawandgrow.online
rebekahlouise.com
herport-fr.com
iphone13.webcam
appz-one.net
inpost-pl.net
promocion360fitness.com
global-forbes.biz
diamondtrade.net
albertcantos.com
gtgits.com
travel-ai.online
busipe6.com
mualikesubvn.com
niftyhandy.com
docprops.com
lido88.bet
baywoodphotography.com
cargosouq.info
newsnowlive.online
floridafishingoverboard.com
missnikissalsa.net
walletvalidate.space
kissimmeeinternationalcup.com
charterhome.school
gurujupiter.com
entertainmentwitchy.com
jokeaou.com
sugarmountainfirearms.com
iss-sa.com
smittyssierra.com
freedomoff.com
giftoin.com
realitystararmwrestling.com
salsalunch-equallyage.com
ladouba.com
thepropertygoat.com
bestofmerrick.guide
4the.top
regioinversiones.com
129qihu.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/432-61-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/432-66-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1644-70-0x00000000001E0000-0x0000000000209000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 380 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
IMG-0046378383.exeIMG-0046378383.execmd.exedescription pid process target process PID 1672 set thread context of 432 1672 IMG-0046378383.exe IMG-0046378383.exe PID 432 set thread context of 1384 432 IMG-0046378383.exe Explorer.EXE PID 432 set thread context of 1384 432 IMG-0046378383.exe Explorer.EXE PID 1644 set thread context of 1384 1644 cmd.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
IMG-0046378383.exeIMG-0046378383.execmd.exepid process 1672 IMG-0046378383.exe 432 IMG-0046378383.exe 432 IMG-0046378383.exe 432 IMG-0046378383.exe 1644 cmd.exe 1644 cmd.exe 1644 cmd.exe 1644 cmd.exe 1644 cmd.exe 1644 cmd.exe 1644 cmd.exe 1644 cmd.exe 1644 cmd.exe 1644 cmd.exe 1644 cmd.exe 1644 cmd.exe 1644 cmd.exe 1644 cmd.exe 1644 cmd.exe 1644 cmd.exe 1644 cmd.exe 1644 cmd.exe 1644 cmd.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
IMG-0046378383.execmd.exepid process 432 IMG-0046378383.exe 432 IMG-0046378383.exe 432 IMG-0046378383.exe 432 IMG-0046378383.exe 1644 cmd.exe 1644 cmd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
IMG-0046378383.exeIMG-0046378383.execmd.exedescription pid process Token: SeDebugPrivilege 1672 IMG-0046378383.exe Token: SeDebugPrivilege 432 IMG-0046378383.exe Token: SeDebugPrivilege 1644 cmd.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
IMG-0046378383.exeExplorer.EXEcmd.exedescription pid process target process PID 1672 wrote to memory of 268 1672 IMG-0046378383.exe IMG-0046378383.exe PID 1672 wrote to memory of 268 1672 IMG-0046378383.exe IMG-0046378383.exe PID 1672 wrote to memory of 268 1672 IMG-0046378383.exe IMG-0046378383.exe PID 1672 wrote to memory of 268 1672 IMG-0046378383.exe IMG-0046378383.exe PID 1672 wrote to memory of 432 1672 IMG-0046378383.exe IMG-0046378383.exe PID 1672 wrote to memory of 432 1672 IMG-0046378383.exe IMG-0046378383.exe PID 1672 wrote to memory of 432 1672 IMG-0046378383.exe IMG-0046378383.exe PID 1672 wrote to memory of 432 1672 IMG-0046378383.exe IMG-0046378383.exe PID 1672 wrote to memory of 432 1672 IMG-0046378383.exe IMG-0046378383.exe PID 1672 wrote to memory of 432 1672 IMG-0046378383.exe IMG-0046378383.exe PID 1672 wrote to memory of 432 1672 IMG-0046378383.exe IMG-0046378383.exe PID 1384 wrote to memory of 1644 1384 Explorer.EXE cmd.exe PID 1384 wrote to memory of 1644 1384 Explorer.EXE cmd.exe PID 1384 wrote to memory of 1644 1384 Explorer.EXE cmd.exe PID 1384 wrote to memory of 1644 1384 Explorer.EXE cmd.exe PID 1644 wrote to memory of 380 1644 cmd.exe cmd.exe PID 1644 wrote to memory of 380 1644 cmd.exe cmd.exe PID 1644 wrote to memory of 380 1644 cmd.exe cmd.exe PID 1644 wrote to memory of 380 1644 cmd.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG-0046378383.exe"C:\Users\Admin\AppData\Local\Temp\IMG-0046378383.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG-0046378383.exe"C:\Users\Admin\AppData\Local\Temp\IMG-0046378383.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG-0046378383.exe"C:\Users\Admin\AppData\Local\Temp\IMG-0046378383.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\IMG-0046378383.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/432-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/432-67-0x00000000001D0000-0x00000000001E1000-memory.dmpFilesize
68KB
-
memory/432-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/432-64-0x0000000000190000-0x00000000001A1000-memory.dmpFilesize
68KB
-
memory/432-63-0x0000000000A40000-0x0000000000D43000-memory.dmpFilesize
3.0MB
-
memory/432-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/432-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1384-68-0x0000000006DF0000-0x0000000006F5B000-memory.dmpFilesize
1.4MB
-
memory/1384-65-0x0000000006CE0000-0x0000000006DEA000-memory.dmpFilesize
1.0MB
-
memory/1384-73-0x00000000025C0000-0x000000000269C000-memory.dmpFilesize
880KB
-
memory/1644-69-0x000000004A2C0000-0x000000004A30C000-memory.dmpFilesize
304KB
-
memory/1644-70-0x00000000001E0000-0x0000000000209000-memory.dmpFilesize
164KB
-
memory/1644-71-0x0000000001EB0000-0x00000000021B3000-memory.dmpFilesize
3.0MB
-
memory/1644-72-0x0000000001CD0000-0x0000000001D60000-memory.dmpFilesize
576KB
-
memory/1672-58-0x00000000012E0000-0x000000000133E000-memory.dmpFilesize
376KB
-
memory/1672-57-0x00000000005F0000-0x0000000000600000-memory.dmpFilesize
64KB
-
memory/1672-56-0x00000000012A0000-0x00000000012A1000-memory.dmpFilesize
4KB
-
memory/1672-54-0x0000000001350000-0x00000000013B4000-memory.dmpFilesize
400KB
-
memory/1672-55-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB