Analysis
-
max time kernel
149s -
max time network
162s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
25-01-2022 07:58
Static task
static1
Behavioral task
behavioral1
Sample
65231303dd5b070c5b5bcbba06839b0d.exe
Resource
win7-en-20211208
General
-
Target
65231303dd5b070c5b5bcbba06839b0d.exe
-
Size
768KB
-
MD5
65231303dd5b070c5b5bcbba06839b0d
-
SHA1
bdf5f1f2fc88253e0dd08b44be841513bcaaf581
-
SHA256
9b26849133bb64946dd7016479a09f500cc3af1386b7cadae5cfa737533f67f0
-
SHA512
753d9569eb18e98d235f441ddf7057bfa3cad04297b37e8e459a4ed84165d180584ab1b86acb70d380cfb8107e16ab87796b77079589841abade34cf46c35b08
Malware Config
Extracted
xloader
2.5
b5ce
xn--qoq07c2d937c.com
centraliaapartment.com
seusucesso.online
paraquat-litigationhelp.com
thatsamirror.com
nwtxxe.website
styledns.com
dalealamusica.com
casixinc.com
candgconstructiontx.com
suityhaluat.quest
tristarmegah.com
soposhshop.com
rosevilletavernandgrillpa.com
galateaspain.com
06mpt.xyz
tongue.services
jw0074awscloud.com
layeronelabs.com
engelbrecht-ayurveda.net
space-vantage.space
galerieblank.com
dogtrainerboulder.com
vindomains.com
nomarktrading.com
systemofsolutions.com
it-novus.com
nakkaszade.online
wafflebank.com
stronghal.com
17957lostcanyon.com
vipergear.store
thedailybeaglenews.com
jdsmission.com
dewapokerasia.net
catix.store
odessa.clinic
bloflui625-nifty.xyz
theberrybuddies.com
blockchain101.tech
decentralutility.com
goodprice.pro
banquanku.biz
jarocomunicacion.com
electricairports.com
goodnft.xyz
palisadestahoeskireport.com
theeluxuryevents.com
lethems.store
ocdpsych.com
shophuunghia.asia
distantcastle.com
limpiezaspricila.com
heatherstepney.com
oficinadeeventos.net
proxivest.com
dogecointraderpro.com
ecars101.com
speedy-boats.com
gz-fplhs.com
barberking.online
bupis44.info
1n2.space
aceentertainment.one
artevictorio.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/592-63-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1324-70-0x0000000000090000-0x00000000000B9000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 15 1324 msiexec.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
65231303dd5b070c5b5bcbba06839b0d.exeMSBuild.exemsiexec.exedescription pid process target process PID 1620 set thread context of 592 1620 65231303dd5b070c5b5bcbba06839b0d.exe MSBuild.exe PID 592 set thread context of 1228 592 MSBuild.exe Explorer.EXE PID 1324 set thread context of 1228 1324 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
MSBuild.exemsiexec.exepid process 592 MSBuild.exe 592 MSBuild.exe 1324 msiexec.exe 1324 msiexec.exe 1324 msiexec.exe 1324 msiexec.exe 1324 msiexec.exe 1324 msiexec.exe 1324 msiexec.exe 1324 msiexec.exe 1324 msiexec.exe 1324 msiexec.exe 1324 msiexec.exe 1324 msiexec.exe 1324 msiexec.exe 1324 msiexec.exe 1324 msiexec.exe 1324 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
MSBuild.exemsiexec.exepid process 592 MSBuild.exe 592 MSBuild.exe 592 MSBuild.exe 1324 msiexec.exe 1324 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
MSBuild.exemsiexec.exedescription pid process Token: SeDebugPrivilege 592 MSBuild.exe Token: SeDebugPrivilege 1324 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
65231303dd5b070c5b5bcbba06839b0d.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1620 wrote to memory of 592 1620 65231303dd5b070c5b5bcbba06839b0d.exe MSBuild.exe PID 1620 wrote to memory of 592 1620 65231303dd5b070c5b5bcbba06839b0d.exe MSBuild.exe PID 1620 wrote to memory of 592 1620 65231303dd5b070c5b5bcbba06839b0d.exe MSBuild.exe PID 1620 wrote to memory of 592 1620 65231303dd5b070c5b5bcbba06839b0d.exe MSBuild.exe PID 1620 wrote to memory of 592 1620 65231303dd5b070c5b5bcbba06839b0d.exe MSBuild.exe PID 1620 wrote to memory of 592 1620 65231303dd5b070c5b5bcbba06839b0d.exe MSBuild.exe PID 1620 wrote to memory of 592 1620 65231303dd5b070c5b5bcbba06839b0d.exe MSBuild.exe PID 1228 wrote to memory of 1324 1228 Explorer.EXE msiexec.exe PID 1228 wrote to memory of 1324 1228 Explorer.EXE msiexec.exe PID 1228 wrote to memory of 1324 1228 Explorer.EXE msiexec.exe PID 1228 wrote to memory of 1324 1228 Explorer.EXE msiexec.exe PID 1228 wrote to memory of 1324 1228 Explorer.EXE msiexec.exe PID 1228 wrote to memory of 1324 1228 Explorer.EXE msiexec.exe PID 1228 wrote to memory of 1324 1228 Explorer.EXE msiexec.exe PID 1324 wrote to memory of 1144 1324 msiexec.exe cmd.exe PID 1324 wrote to memory of 1144 1324 msiexec.exe cmd.exe PID 1324 wrote to memory of 1144 1324 msiexec.exe cmd.exe PID 1324 wrote to memory of 1144 1324 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\65231303dd5b070c5b5bcbba06839b0d.exe"C:\Users\Admin\AppData\Local\Temp\65231303dd5b070c5b5bcbba06839b0d.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/592-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/592-66-0x0000000000140000-0x0000000000151000-memory.dmpFilesize
68KB
-
memory/592-65-0x0000000000890000-0x0000000000C93000-memory.dmpFilesize
4.0MB
-
memory/592-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/592-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1228-73-0x0000000004BE0000-0x0000000004C74000-memory.dmpFilesize
592KB
-
memory/1228-67-0x0000000006190000-0x00000000062A1000-memory.dmpFilesize
1.1MB
-
memory/1324-69-0x0000000000950000-0x0000000000964000-memory.dmpFilesize
80KB
-
memory/1324-70-0x0000000000090000-0x00000000000B9000-memory.dmpFilesize
164KB
-
memory/1324-71-0x00000000022B0000-0x00000000025B3000-memory.dmpFilesize
3.0MB
-
memory/1324-72-0x0000000000380000-0x00000000006A9000-memory.dmpFilesize
3.2MB
-
memory/1620-60-0x0000000004390000-0x0000000004436000-memory.dmpFilesize
664KB
-
memory/1620-59-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/1620-58-0x0000000000660000-0x000000000066E000-memory.dmpFilesize
56KB
-
memory/1620-57-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/1620-55-0x0000000000D90000-0x0000000000E58000-memory.dmpFilesize
800KB
-
memory/1620-56-0x00000000763F1000-0x00000000763F3000-memory.dmpFilesize
8KB