Analysis
-
max time kernel
167s -
max time network
164s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 07:58
Static task
static1
Behavioral task
behavioral1
Sample
65231303dd5b070c5b5bcbba06839b0d.exe
Resource
win7-en-20211208
General
-
Target
65231303dd5b070c5b5bcbba06839b0d.exe
-
Size
768KB
-
MD5
65231303dd5b070c5b5bcbba06839b0d
-
SHA1
bdf5f1f2fc88253e0dd08b44be841513bcaaf581
-
SHA256
9b26849133bb64946dd7016479a09f500cc3af1386b7cadae5cfa737533f67f0
-
SHA512
753d9569eb18e98d235f441ddf7057bfa3cad04297b37e8e459a4ed84165d180584ab1b86acb70d380cfb8107e16ab87796b77079589841abade34cf46c35b08
Malware Config
Extracted
xloader
2.5
b5ce
xn--qoq07c2d937c.com
centraliaapartment.com
seusucesso.online
paraquat-litigationhelp.com
thatsamirror.com
nwtxxe.website
styledns.com
dalealamusica.com
casixinc.com
candgconstructiontx.com
suityhaluat.quest
tristarmegah.com
soposhshop.com
rosevilletavernandgrillpa.com
galateaspain.com
06mpt.xyz
tongue.services
jw0074awscloud.com
layeronelabs.com
engelbrecht-ayurveda.net
space-vantage.space
galerieblank.com
dogtrainerboulder.com
vindomains.com
nomarktrading.com
systemofsolutions.com
it-novus.com
nakkaszade.online
wafflebank.com
stronghal.com
17957lostcanyon.com
vipergear.store
thedailybeaglenews.com
jdsmission.com
dewapokerasia.net
catix.store
odessa.clinic
bloflui625-nifty.xyz
theberrybuddies.com
blockchain101.tech
decentralutility.com
goodprice.pro
banquanku.biz
jarocomunicacion.com
electricairports.com
goodnft.xyz
palisadestahoeskireport.com
theeluxuryevents.com
lethems.store
ocdpsych.com
shophuunghia.asia
distantcastle.com
limpiezaspricila.com
heatherstepney.com
oficinadeeventos.net
proxivest.com
dogecointraderpro.com
ecars101.com
speedy-boats.com
gz-fplhs.com
barberking.online
bupis44.info
1n2.space
aceentertainment.one
artevictorio.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3984-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/744-131-0x00000000029A0000-0x00000000029C9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
65231303dd5b070c5b5bcbba06839b0d.exeMSBuild.exemsdt.exedescription pid process target process PID 3192 set thread context of 3984 3192 65231303dd5b070c5b5bcbba06839b0d.exe MSBuild.exe PID 3984 set thread context of 3032 3984 MSBuild.exe Explorer.EXE PID 744 set thread context of 3032 744 msdt.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
MSBuild.exemsdt.exepid process 3984 MSBuild.exe 3984 MSBuild.exe 3984 MSBuild.exe 3984 MSBuild.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe 744 msdt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3032 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
MSBuild.exemsdt.exepid process 3984 MSBuild.exe 3984 MSBuild.exe 3984 MSBuild.exe 744 msdt.exe 744 msdt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
MSBuild.exemsdt.exedescription pid process Token: SeDebugPrivilege 3984 MSBuild.exe Token: SeDebugPrivilege 744 msdt.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
65231303dd5b070c5b5bcbba06839b0d.exeExplorer.EXEmsdt.exedescription pid process target process PID 3192 wrote to memory of 3984 3192 65231303dd5b070c5b5bcbba06839b0d.exe MSBuild.exe PID 3192 wrote to memory of 3984 3192 65231303dd5b070c5b5bcbba06839b0d.exe MSBuild.exe PID 3192 wrote to memory of 3984 3192 65231303dd5b070c5b5bcbba06839b0d.exe MSBuild.exe PID 3192 wrote to memory of 3984 3192 65231303dd5b070c5b5bcbba06839b0d.exe MSBuild.exe PID 3192 wrote to memory of 3984 3192 65231303dd5b070c5b5bcbba06839b0d.exe MSBuild.exe PID 3192 wrote to memory of 3984 3192 65231303dd5b070c5b5bcbba06839b0d.exe MSBuild.exe PID 3032 wrote to memory of 744 3032 Explorer.EXE msdt.exe PID 3032 wrote to memory of 744 3032 Explorer.EXE msdt.exe PID 3032 wrote to memory of 744 3032 Explorer.EXE msdt.exe PID 744 wrote to memory of 2812 744 msdt.exe cmd.exe PID 744 wrote to memory of 2812 744 msdt.exe cmd.exe PID 744 wrote to memory of 2812 744 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\65231303dd5b070c5b5bcbba06839b0d.exe"C:\Users\Admin\AppData\Local\Temp\65231303dd5b070c5b5bcbba06839b0d.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/744-133-0x0000000004830000-0x00000000049CE000-memory.dmpFilesize
1.6MB
-
memory/744-132-0x00000000049D0000-0x0000000004CF0000-memory.dmpFilesize
3.1MB
-
memory/744-130-0x0000000000370000-0x00000000004E3000-memory.dmpFilesize
1.4MB
-
memory/744-131-0x00000000029A0000-0x00000000029C9000-memory.dmpFilesize
164KB
-
memory/3032-129-0x0000000002DD0000-0x0000000002E88000-memory.dmpFilesize
736KB
-
memory/3032-134-0x00000000064A0000-0x0000000006615000-memory.dmpFilesize
1.5MB
-
memory/3192-120-0x0000000005120000-0x000000000561E000-memory.dmpFilesize
5.0MB
-
memory/3192-123-0x0000000007610000-0x000000000761E000-memory.dmpFilesize
56KB
-
memory/3192-124-0x0000000007AC0000-0x0000000007B66000-memory.dmpFilesize
664KB
-
memory/3192-122-0x000000007F2A0000-0x000000007F2A1000-memory.dmpFilesize
4KB
-
memory/3192-121-0x0000000007630000-0x00000000076CC000-memory.dmpFilesize
624KB
-
memory/3192-116-0x00000000007F0000-0x00000000008B8000-memory.dmpFilesize
800KB
-
memory/3192-119-0x0000000005100000-0x000000000510A000-memory.dmpFilesize
40KB
-
memory/3192-118-0x00000000051C0000-0x0000000005252000-memory.dmpFilesize
584KB
-
memory/3192-117-0x0000000005620000-0x0000000005B1E000-memory.dmpFilesize
5.0MB
-
memory/3984-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3984-127-0x0000000001200000-0x0000000001520000-memory.dmpFilesize
3.1MB
-
memory/3984-128-0x0000000000B00000-0x0000000000C4A000-memory.dmpFilesize
1.3MB