Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 12:50
Static task
static1
Behavioral task
behavioral1
Sample
AeYNBknvOvHA5AC.exe
Resource
win7-en-20211208
General
-
Target
AeYNBknvOvHA5AC.exe
-
Size
538KB
-
MD5
b6fd4235daa49fa3f4ee1b2618edab38
-
SHA1
07e4b0ea42af774a704455bead341d335a5ef41c
-
SHA256
b1fdff098dabc1d5beb91484f6f82637f359cb0f7fb4764b282c299c2d341ffa
-
SHA512
8d7bae24068158ac77128c0d594c32daa130c90d92c7ec6040efd9f86a16688cb9445b6ca570cef3f2e01dfbfe7d5fd5f14b46bed1bf773b368aa2964fc4e666
Malware Config
Extracted
xloader
2.5
p89m
wrapapplausechutney.xyz
covidmobiletestingmd.com
convey.gifts
b148tlrfee9evtvorgm5947.com
zmlhtjfls.com
mctrumpthyism.com
lilaixi.store
interstatehardwarenj.com
horakokode.com
42wilsonavenue.com
muskanphysio.com
absoluteuniquecrafts.store
donategame.online
greenlinkengineering.net
pinchanzosloyalty.com
companyintel.network
resumewriterguru.com
oakalleyatcimarron.com
sriyawealthplan.com
mpcollection.online
desclaw.net
amanchugera.com
intellicomeg.com
ejevisual.net
datwayclothing.com
swflgehc.com
arjweb.com
novatel-network.com
pixelmarketings.com
shopmoly.com
royalproxymarketing.com
getgavastore.com
firstborneggs.com
beautyrgv.info
nysshq.com
kainaatkurd.com
dustriaservices.com
eliamhome.com
040skz.xyz
transfer666.online
kjeftsizing.quest
awano-houmon.com
cybermve.online
25mpt.xyz
taicholdingglobal.com
shebreaksvegas.com
194ac.com
camimac.com
pufoil.com
leord.tech
algurgtyres-uae.com
familienstartup.com
932381.com
thebestsmartphones.com
techdotsystems.com
epowersportstechshow.com
ci-ohio.com
worldofman.art
juno-mariage.com
knowhepfoundation.com
fruitdonuts.com
hongshangxx.com
gf58573.com
leecoga.com
xn--reljame-jwa.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3424-123-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/560-129-0x0000000004D50000-0x0000000004D79000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
AeYNBknvOvHA5AC.exeAeYNBknvOvHA5AC.exechkdsk.exedescription pid process target process PID 3764 set thread context of 3424 3764 AeYNBknvOvHA5AC.exe AeYNBknvOvHA5AC.exe PID 3424 set thread context of 3024 3424 AeYNBknvOvHA5AC.exe Explorer.EXE PID 560 set thread context of 3024 560 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
AeYNBknvOvHA5AC.exeAeYNBknvOvHA5AC.exechkdsk.exepid process 3764 AeYNBknvOvHA5AC.exe 3764 AeYNBknvOvHA5AC.exe 3764 AeYNBknvOvHA5AC.exe 3764 AeYNBknvOvHA5AC.exe 3764 AeYNBknvOvHA5AC.exe 3764 AeYNBknvOvHA5AC.exe 3424 AeYNBknvOvHA5AC.exe 3424 AeYNBknvOvHA5AC.exe 3424 AeYNBknvOvHA5AC.exe 3424 AeYNBknvOvHA5AC.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe 560 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3024 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
AeYNBknvOvHA5AC.exechkdsk.exepid process 3424 AeYNBknvOvHA5AC.exe 3424 AeYNBknvOvHA5AC.exe 3424 AeYNBknvOvHA5AC.exe 560 chkdsk.exe 560 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
AeYNBknvOvHA5AC.exeAeYNBknvOvHA5AC.exeExplorer.EXEchkdsk.exedescription pid process Token: SeDebugPrivilege 3764 AeYNBknvOvHA5AC.exe Token: SeDebugPrivilege 3424 AeYNBknvOvHA5AC.exe Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeDebugPrivilege 560 chkdsk.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
AeYNBknvOvHA5AC.exeExplorer.EXEchkdsk.exedescription pid process target process PID 3764 wrote to memory of 3600 3764 AeYNBknvOvHA5AC.exe AeYNBknvOvHA5AC.exe PID 3764 wrote to memory of 3600 3764 AeYNBknvOvHA5AC.exe AeYNBknvOvHA5AC.exe PID 3764 wrote to memory of 3600 3764 AeYNBknvOvHA5AC.exe AeYNBknvOvHA5AC.exe PID 3764 wrote to memory of 1724 3764 AeYNBknvOvHA5AC.exe AeYNBknvOvHA5AC.exe PID 3764 wrote to memory of 1724 3764 AeYNBknvOvHA5AC.exe AeYNBknvOvHA5AC.exe PID 3764 wrote to memory of 1724 3764 AeYNBknvOvHA5AC.exe AeYNBknvOvHA5AC.exe PID 3764 wrote to memory of 3472 3764 AeYNBknvOvHA5AC.exe AeYNBknvOvHA5AC.exe PID 3764 wrote to memory of 3472 3764 AeYNBknvOvHA5AC.exe AeYNBknvOvHA5AC.exe PID 3764 wrote to memory of 3472 3764 AeYNBknvOvHA5AC.exe AeYNBknvOvHA5AC.exe PID 3764 wrote to memory of 3424 3764 AeYNBknvOvHA5AC.exe AeYNBknvOvHA5AC.exe PID 3764 wrote to memory of 3424 3764 AeYNBknvOvHA5AC.exe AeYNBknvOvHA5AC.exe PID 3764 wrote to memory of 3424 3764 AeYNBknvOvHA5AC.exe AeYNBknvOvHA5AC.exe PID 3764 wrote to memory of 3424 3764 AeYNBknvOvHA5AC.exe AeYNBknvOvHA5AC.exe PID 3764 wrote to memory of 3424 3764 AeYNBknvOvHA5AC.exe AeYNBknvOvHA5AC.exe PID 3764 wrote to memory of 3424 3764 AeYNBknvOvHA5AC.exe AeYNBknvOvHA5AC.exe PID 3024 wrote to memory of 560 3024 Explorer.EXE chkdsk.exe PID 3024 wrote to memory of 560 3024 Explorer.EXE chkdsk.exe PID 3024 wrote to memory of 560 3024 Explorer.EXE chkdsk.exe PID 560 wrote to memory of 1592 560 chkdsk.exe cmd.exe PID 560 wrote to memory of 1592 560 chkdsk.exe cmd.exe PID 560 wrote to memory of 1592 560 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/560-131-0x0000000005430000-0x00000000054C0000-memory.dmpFilesize
576KB
-
memory/560-130-0x0000000005000000-0x00000000050AE000-memory.dmpFilesize
696KB
-
memory/560-129-0x0000000004D50000-0x0000000004D79000-memory.dmpFilesize
164KB
-
memory/560-128-0x00000000001F0000-0x00000000001FA000-memory.dmpFilesize
40KB
-
memory/3024-126-0x0000000004B40000-0x0000000004CCB000-memory.dmpFilesize
1.5MB
-
memory/3024-132-0x00000000024B0000-0x0000000002567000-memory.dmpFilesize
732KB
-
memory/3424-123-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3424-125-0x0000000001330000-0x0000000001650000-memory.dmpFilesize
3.1MB
-
memory/3424-127-0x0000000001800000-0x0000000001811000-memory.dmpFilesize
68KB
-
memory/3764-122-0x0000000007CF0000-0x0000000007D52000-memory.dmpFilesize
392KB
-
memory/3764-115-0x0000000000B30000-0x0000000000BBC000-memory.dmpFilesize
560KB
-
memory/3764-121-0x0000000007B40000-0x0000000007BDC000-memory.dmpFilesize
624KB
-
memory/3764-120-0x00000000053A0000-0x000000000589E000-memory.dmpFilesize
5.0MB
-
memory/3764-119-0x0000000005890000-0x000000000589C000-memory.dmpFilesize
48KB
-
memory/3764-118-0x0000000005430000-0x000000000543A000-memory.dmpFilesize
40KB
-
memory/3764-117-0x0000000005440000-0x00000000054D2000-memory.dmpFilesize
584KB
-
memory/3764-116-0x00000000058A0000-0x0000000005D9E000-memory.dmpFilesize
5.0MB