Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
25-01-2022 12:50
Static task
static1
Behavioral task
behavioral1
Sample
SNO22 595406_RACX-159814.exe
Resource
win7-en-20211208
General
-
Target
SNO22 595406_RACX-159814.exe
-
Size
819KB
-
MD5
b5c5e59e2ced576d7897a76f8e2bcca5
-
SHA1
2d9bf0b46cd37f89be12d12c36ed833894e8e749
-
SHA256
d80d56cfde862aefb9ea4a4195b12cafc5e93f60bb13d2e1a8a1a5b6fe49d9c5
-
SHA512
124b9c1a53eff953fa0c5d9b8b2704523a3e26f7fab1c6a677df36ec9ba02d5e352d3f4d249b3e8a56309875b37bc6c8d114be4aec0ba4abd9260144f749cacd
Malware Config
Extracted
xloader
2.5
p8ce
wishmeluck1.xyz
nawabumi.com
terra.fish
eoraipsumami.quest
awakeningyourid.com
csyein.com
tslsinteligentes.com
cataractusa.com
capitalwheelstogo.com
staffremotely.com
trashbinwasher.com
blaneyparkrendezvous.com
yolrt.com
northendtaproom.com
showgeini.com
b95206.com
almcpersonaltraining.com
lovabledoodleshome.com
woodlandstationcondos.com
nikahlive.com
sassholesentiments.com
bupis44.info
salahiheartclinic.com
loveandpersonality.com
electric-cortex.com
beijixing-zs.com
proper-sa.com
legacyfamilypartners.com
psidsamor.com
schotinderoos.com
kosma-concept.com
onitled.com
zscyyds.xyz
mannatgroups.com
radweb-demo.com
lambanghieuquangcao.info
antabatik.com
lerongclub.com
mobssvipshop.com
dr-walther.com
ibexitconsultants.com
cnyprospects.com
j9mkt64.com
archer-claims.com
lggrandinn.com
jowhp.com
outdoormz.store
cantikgroup.company
2brothersprinting.com
ginamodernart.com
koupeespen.quest
senerants.tech
designthrottle.com
emquality.com
cerulesafe.com
orascomservice.com
skinsotight.com
premiumconciergemarbella.com
cottagepor.xyz
gwayav.com
johnguidesyou.com
corporativokale.com
jskswj.com
xinico.info
gebaeudetechnik-burscheid.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/564-61-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1676-67-0x00000000001D0000-0x00000000001F9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1704 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SNO22 595406_RACX-159814.exeSNO22 595406_RACX-159814.execmd.exedescription pid process target process PID 1220 set thread context of 564 1220 SNO22 595406_RACX-159814.exe SNO22 595406_RACX-159814.exe PID 564 set thread context of 1292 564 SNO22 595406_RACX-159814.exe Explorer.EXE PID 1676 set thread context of 1292 1676 cmd.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
SNO22 595406_RACX-159814.exeSNO22 595406_RACX-159814.execmd.exepid process 1220 SNO22 595406_RACX-159814.exe 564 SNO22 595406_RACX-159814.exe 564 SNO22 595406_RACX-159814.exe 1676 cmd.exe 1676 cmd.exe 1676 cmd.exe 1676 cmd.exe 1676 cmd.exe 1676 cmd.exe 1676 cmd.exe 1676 cmd.exe 1676 cmd.exe 1676 cmd.exe 1676 cmd.exe 1676 cmd.exe 1676 cmd.exe 1676 cmd.exe 1676 cmd.exe 1676 cmd.exe 1676 cmd.exe 1676 cmd.exe 1676 cmd.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
SNO22 595406_RACX-159814.execmd.exepid process 564 SNO22 595406_RACX-159814.exe 564 SNO22 595406_RACX-159814.exe 564 SNO22 595406_RACX-159814.exe 1676 cmd.exe 1676 cmd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SNO22 595406_RACX-159814.exeSNO22 595406_RACX-159814.execmd.exedescription pid process Token: SeDebugPrivilege 1220 SNO22 595406_RACX-159814.exe Token: SeDebugPrivilege 564 SNO22 595406_RACX-159814.exe Token: SeDebugPrivilege 1676 cmd.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1292 Explorer.EXE 1292 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1292 Explorer.EXE 1292 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
SNO22 595406_RACX-159814.exeExplorer.EXEcmd.exedescription pid process target process PID 1220 wrote to memory of 112 1220 SNO22 595406_RACX-159814.exe SNO22 595406_RACX-159814.exe PID 1220 wrote to memory of 112 1220 SNO22 595406_RACX-159814.exe SNO22 595406_RACX-159814.exe PID 1220 wrote to memory of 112 1220 SNO22 595406_RACX-159814.exe SNO22 595406_RACX-159814.exe PID 1220 wrote to memory of 112 1220 SNO22 595406_RACX-159814.exe SNO22 595406_RACX-159814.exe PID 1220 wrote to memory of 564 1220 SNO22 595406_RACX-159814.exe SNO22 595406_RACX-159814.exe PID 1220 wrote to memory of 564 1220 SNO22 595406_RACX-159814.exe SNO22 595406_RACX-159814.exe PID 1220 wrote to memory of 564 1220 SNO22 595406_RACX-159814.exe SNO22 595406_RACX-159814.exe PID 1220 wrote to memory of 564 1220 SNO22 595406_RACX-159814.exe SNO22 595406_RACX-159814.exe PID 1220 wrote to memory of 564 1220 SNO22 595406_RACX-159814.exe SNO22 595406_RACX-159814.exe PID 1220 wrote to memory of 564 1220 SNO22 595406_RACX-159814.exe SNO22 595406_RACX-159814.exe PID 1220 wrote to memory of 564 1220 SNO22 595406_RACX-159814.exe SNO22 595406_RACX-159814.exe PID 1292 wrote to memory of 1676 1292 Explorer.EXE cmd.exe PID 1292 wrote to memory of 1676 1292 Explorer.EXE cmd.exe PID 1292 wrote to memory of 1676 1292 Explorer.EXE cmd.exe PID 1292 wrote to memory of 1676 1292 Explorer.EXE cmd.exe PID 1676 wrote to memory of 1704 1676 cmd.exe cmd.exe PID 1676 wrote to memory of 1704 1676 cmd.exe cmd.exe PID 1676 wrote to memory of 1704 1676 cmd.exe cmd.exe PID 1676 wrote to memory of 1704 1676 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SNO22 595406_RACX-159814.exe"C:\Users\Admin\AppData\Local\Temp\SNO22 595406_RACX-159814.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SNO22 595406_RACX-159814.exe"C:\Users\Admin\AppData\Local\Temp\SNO22 595406_RACX-159814.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SNO22 595406_RACX-159814.exe"C:\Users\Admin\AppData\Local\Temp\SNO22 595406_RACX-159814.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SNO22 595406_RACX-159814.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/564-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/564-64-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/564-63-0x0000000000860000-0x0000000000B63000-memory.dmpFilesize
3.0MB
-
memory/564-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/564-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1220-57-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/1220-58-0x0000000005390000-0x0000000005434000-memory.dmpFilesize
656KB
-
memory/1220-53-0x0000000000F30000-0x0000000001004000-memory.dmpFilesize
848KB
-
memory/1220-56-0x0000000000950000-0x000000000095E000-memory.dmpFilesize
56KB
-
memory/1220-55-0x0000000002410000-0x00000000044A0000-memory.dmpFilesize
32.6MB
-
memory/1220-54-0x0000000076071000-0x0000000076073000-memory.dmpFilesize
8KB
-
memory/1292-65-0x00000000048E0000-0x00000000049B7000-memory.dmpFilesize
860KB
-
memory/1292-70-0x0000000006610000-0x00000000066F6000-memory.dmpFilesize
920KB
-
memory/1676-66-0x000000004AB00000-0x000000004AB4C000-memory.dmpFilesize
304KB
-
memory/1676-67-0x00000000001D0000-0x00000000001F9000-memory.dmpFilesize
164KB
-
memory/1676-68-0x0000000002080000-0x0000000002383000-memory.dmpFilesize
3.0MB
-
memory/1676-69-0x0000000001DB0000-0x0000000001E40000-memory.dmpFilesize
576KB