Analysis
-
max time kernel
161s -
max time network
157s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 11:18
Static task
static1
Behavioral task
behavioral1
Sample
GV8EJooYMIgEnEk.exe
Resource
win7-en-20211208
General
-
Target
GV8EJooYMIgEnEk.exe
-
Size
382KB
-
MD5
cf6d4fd3dc8e4751b7f89f857b618ef3
-
SHA1
15b95f0f1b5785bb7fd3d97757f3eea49d1f6951
-
SHA256
9689e8e0cf51b8b5c98ddb007636d8acf7e03c9cc8a7bf99aafdaaebae2dfb3a
-
SHA512
86af327caf1d55c8d3dd1e2319dcae1faaf7db82fb2fdce83999b0a4e5c6af2ce700fb0c69f568169110f04b9af6543e069aee59101370d6af060d8d4763d43f
Malware Config
Extracted
xloader
2.5
cbgo
tablescaperendezvous4two.net
abktransportllc.net
roseevision.com
skategrindingwheels.com
robux-generator-free.xyz
yacusi.com
mgav35.xyz
paravocecommerce.com
venkatramanrm.com
freakyhamster.com
jenaashoponline.com
dmozlisting.com
lorrainekclark.store
handyman-prime.com
thecrashingbrains.com
ukpms.com
livingstonemines.com
papeisonline.com
chrisbakerpr.com
omnipets.store
anatox-lab.fr
missingthered.com
himalaya-nepalorganic.com
bitcoin-bot.xyz
velarusbet78.com
redesignyourpain.com
alonetogetherentertainment.com
sandywalling.com
solacegolf.com
charlottesbestroofcompany.com
stefanybeauty.com
webarate.com
experiencedlawfirms.com
lyfygthj.com
monoicstudios.com
rgamming.com
mintique.pro
totalwinerewards.com
praelatusproducts.com
daniloff.pro
qmir.digital
tatasteell.com
casatowerofficial.com
sunrisespaandbodywork.com
mgav66.xyz
bastnbt.com
fabiulaezeca.com
sunmountainautomotive.com
madgeniustalk.com
elite-hc.com
billcurdmusic.net
foxclothings.com
adtcmrac.com
buresdx.com
tothelaundry.com
bitconga.com
onlinebiyoloji.online
up-trend.store
kaarlehto.com
interview.online
grantgroupproperties.com
jpmhomes.net
yinlimine.xyz
roadtrippings.com
cottoneworld.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1016-126-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1016-131-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1756-135-0x0000000002CA0000-0x0000000002CC9000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
GV8EJooYMIgEnEk.exeGV8EJooYMIgEnEk.execmmon32.exedescription pid process target process PID 4084 set thread context of 1016 4084 GV8EJooYMIgEnEk.exe GV8EJooYMIgEnEk.exe PID 1016 set thread context of 2472 1016 GV8EJooYMIgEnEk.exe Explorer.EXE PID 1016 set thread context of 2472 1016 GV8EJooYMIgEnEk.exe Explorer.EXE PID 1756 set thread context of 2472 1756 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
GV8EJooYMIgEnEk.execmmon32.exepid process 1016 GV8EJooYMIgEnEk.exe 1016 GV8EJooYMIgEnEk.exe 1016 GV8EJooYMIgEnEk.exe 1016 GV8EJooYMIgEnEk.exe 1016 GV8EJooYMIgEnEk.exe 1016 GV8EJooYMIgEnEk.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe 1756 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2472 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
GV8EJooYMIgEnEk.execmmon32.exepid process 1016 GV8EJooYMIgEnEk.exe 1016 GV8EJooYMIgEnEk.exe 1016 GV8EJooYMIgEnEk.exe 1016 GV8EJooYMIgEnEk.exe 1756 cmmon32.exe 1756 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
GV8EJooYMIgEnEk.execmmon32.exedescription pid process Token: SeDebugPrivilege 1016 GV8EJooYMIgEnEk.exe Token: SeDebugPrivilege 1756 cmmon32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
GV8EJooYMIgEnEk.exeExplorer.EXEcmmon32.exedescription pid process target process PID 4084 wrote to memory of 1016 4084 GV8EJooYMIgEnEk.exe GV8EJooYMIgEnEk.exe PID 4084 wrote to memory of 1016 4084 GV8EJooYMIgEnEk.exe GV8EJooYMIgEnEk.exe PID 4084 wrote to memory of 1016 4084 GV8EJooYMIgEnEk.exe GV8EJooYMIgEnEk.exe PID 4084 wrote to memory of 1016 4084 GV8EJooYMIgEnEk.exe GV8EJooYMIgEnEk.exe PID 4084 wrote to memory of 1016 4084 GV8EJooYMIgEnEk.exe GV8EJooYMIgEnEk.exe PID 4084 wrote to memory of 1016 4084 GV8EJooYMIgEnEk.exe GV8EJooYMIgEnEk.exe PID 2472 wrote to memory of 1756 2472 Explorer.EXE cmmon32.exe PID 2472 wrote to memory of 1756 2472 Explorer.EXE cmmon32.exe PID 2472 wrote to memory of 1756 2472 Explorer.EXE cmmon32.exe PID 1756 wrote to memory of 2536 1756 cmmon32.exe cmd.exe PID 1756 wrote to memory of 2536 1756 cmmon32.exe cmd.exe PID 1756 wrote to memory of 2536 1756 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GV8EJooYMIgEnEk.exe"C:\Users\Admin\AppData\Local\Temp\GV8EJooYMIgEnEk.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GV8EJooYMIgEnEk.exe"C:\Users\Admin\AppData\Local\Temp\GV8EJooYMIgEnEk.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\GV8EJooYMIgEnEk.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1016-126-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1016-132-0x0000000001070000-0x0000000001081000-memory.dmpFilesize
68KB
-
memory/1016-131-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1016-129-0x0000000000F00000-0x000000000104A000-memory.dmpFilesize
1.3MB
-
memory/1016-128-0x0000000001560000-0x0000000001880000-memory.dmpFilesize
3.1MB
-
memory/1756-135-0x0000000002CA0000-0x0000000002CC9000-memory.dmpFilesize
164KB
-
memory/1756-137-0x00000000041D0000-0x0000000004361000-memory.dmpFilesize
1.6MB
-
memory/1756-136-0x0000000004500000-0x0000000004820000-memory.dmpFilesize
3.1MB
-
memory/1756-134-0x00000000001E0000-0x00000000001EC000-memory.dmpFilesize
48KB
-
memory/2472-133-0x00000000053D0000-0x0000000005515000-memory.dmpFilesize
1.3MB
-
memory/2472-138-0x0000000002DD0000-0x0000000002E7F000-memory.dmpFilesize
700KB
-
memory/2472-130-0x0000000002C50000-0x0000000002D12000-memory.dmpFilesize
776KB
-
memory/4084-120-0x0000000004A10000-0x0000000004AA2000-memory.dmpFilesize
584KB
-
memory/4084-119-0x0000000004E70000-0x000000000536E000-memory.dmpFilesize
5.0MB
-
memory/4084-124-0x00000000070E0000-0x000000000717C000-memory.dmpFilesize
624KB
-
memory/4084-118-0x0000000000130000-0x0000000000196000-memory.dmpFilesize
408KB
-
memory/4084-121-0x00000000049E0000-0x00000000049EA000-memory.dmpFilesize
40KB
-
memory/4084-122-0x0000000004970000-0x0000000004E6E000-memory.dmpFilesize
5.0MB
-
memory/4084-123-0x0000000004C20000-0x0000000004C2C000-memory.dmpFilesize
48KB
-
memory/4084-125-0x0000000007260000-0x00000000072C2000-memory.dmpFilesize
392KB