Analysis
-
max time kernel
151s -
max time network
160s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 14:40
Static task
static1
Behavioral task
behavioral1
Sample
enquiry no. 2770034921.exe
Resource
win7-en-20211208
General
-
Target
enquiry no. 2770034921.exe
-
Size
381KB
-
MD5
5dde426d4383be37f818ee1205c50e11
-
SHA1
060c70157ceea0b08243a53e4baae2331b4449f8
-
SHA256
3f277a6819833eb0c7feab4e952301b4bac883e38ec8bd266093b6757d1920e8
-
SHA512
3b56d429b5d471cda4a8087dca70d74093bc3ac55a0cefba7949a76b254927d1ccadbbbf5a60554162817e930ed83ecf1515745763c0f13680c4ca9548054ac3
Malware Config
Extracted
xloader
2.5
gab7
mbb11.xyz
taishancable.com
karaoke-sega.com
mana-space.com
danielandkaela.com
ancorasports.com
magentaclass.com
tenloe045.xyz
colorbold.com
5starrentertainment.com
candgconstructiontx.com
664cqi.com
alexeykazakov.com
umrashed.space
thepowerof10.club
scotchwoodofficeworks.com
anelis.digital
label34.group
karimico.com
dogsforsaleinkenya.com
optamiaads.com
gobgamon.com
cfphin.com
parsian-shetab.com
lumensoycandles.com
rakyatnews.online
tiendasu.com
244.house
thecrazyfarm.com
ibotvideos.com
foxyreal.website
egeolabs.com
becu84ts.com
investorsank.com
sagekimgray.com
eco1tnpasumo5.xyz
jingtailan-china.com
covapa2.com
yijiaclcs.com
uni-mia.com
english-sports.info
thinkercleaningservice.com
doislot.xyz
studiosagesalon.com
xn--z4qv1cr56dk0k.group
greencrvn.com
kabloomevents.com
backgammondestinations.net
exploitporbrl.xyz
twoindividuals.com
innisfailcleaning.com
kontrolnb.com
pinaldrywall.com
boettcherlaw.com
nano-shred.com
arinatechnology.com
mfkplatinum.info
ddfddpistol.quest
scarpatostudiolegale.com
scatfilms.biz
investmentcomp.com
xemphimlatmat5.com
phsenterprises.com
accutitleagency.biz
i8news-be.website
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/984-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3276-131-0x0000000000BD0000-0x0000000000BF9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
enquiry no. 2770034921.exeenquiry no. 2770034921.execolorcpl.exedescription pid process target process PID 3484 set thread context of 984 3484 enquiry no. 2770034921.exe enquiry no. 2770034921.exe PID 984 set thread context of 3056 984 enquiry no. 2770034921.exe Explorer.EXE PID 3276 set thread context of 3056 3276 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
enquiry no. 2770034921.execolorcpl.exepid process 984 enquiry no. 2770034921.exe 984 enquiry no. 2770034921.exe 984 enquiry no. 2770034921.exe 984 enquiry no. 2770034921.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe 3276 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3056 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
enquiry no. 2770034921.execolorcpl.exepid process 984 enquiry no. 2770034921.exe 984 enquiry no. 2770034921.exe 984 enquiry no. 2770034921.exe 3276 colorcpl.exe 3276 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
enquiry no. 2770034921.execolorcpl.exedescription pid process Token: SeDebugPrivilege 984 enquiry no. 2770034921.exe Token: SeDebugPrivilege 3276 colorcpl.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
enquiry no. 2770034921.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 3484 wrote to memory of 984 3484 enquiry no. 2770034921.exe enquiry no. 2770034921.exe PID 3484 wrote to memory of 984 3484 enquiry no. 2770034921.exe enquiry no. 2770034921.exe PID 3484 wrote to memory of 984 3484 enquiry no. 2770034921.exe enquiry no. 2770034921.exe PID 3484 wrote to memory of 984 3484 enquiry no. 2770034921.exe enquiry no. 2770034921.exe PID 3484 wrote to memory of 984 3484 enquiry no. 2770034921.exe enquiry no. 2770034921.exe PID 3484 wrote to memory of 984 3484 enquiry no. 2770034921.exe enquiry no. 2770034921.exe PID 3056 wrote to memory of 3276 3056 Explorer.EXE colorcpl.exe PID 3056 wrote to memory of 3276 3056 Explorer.EXE colorcpl.exe PID 3056 wrote to memory of 3276 3056 Explorer.EXE colorcpl.exe PID 3276 wrote to memory of 632 3276 colorcpl.exe cmd.exe PID 3276 wrote to memory of 632 3276 colorcpl.exe cmd.exe PID 3276 wrote to memory of 632 3276 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\enquiry no. 2770034921.exe"C:\Users\Admin\AppData\Local\Temp\enquiry no. 2770034921.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\enquiry no. 2770034921.exe"C:\Users\Admin\AppData\Local\Temp\enquiry no. 2770034921.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\enquiry no. 2770034921.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/984-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/984-128-0x00000000015A0000-0x00000000015B1000-memory.dmpFilesize
68KB
-
memory/984-127-0x0000000001A40000-0x0000000001D60000-memory.dmpFilesize
3.1MB
-
memory/3056-134-0x0000000006CC0000-0x0000000006E07000-memory.dmpFilesize
1.3MB
-
memory/3056-129-0x0000000006B70000-0x0000000006CB7000-memory.dmpFilesize
1.3MB
-
memory/3276-131-0x0000000000BD0000-0x0000000000BF9000-memory.dmpFilesize
164KB
-
memory/3276-130-0x00000000010D0000-0x00000000010E9000-memory.dmpFilesize
100KB
-
memory/3276-132-0x0000000004D10000-0x0000000005030000-memory.dmpFilesize
3.1MB
-
memory/3276-133-0x00000000049D0000-0x0000000004B62000-memory.dmpFilesize
1.6MB
-
memory/3484-123-0x00000000074C0000-0x000000000755C000-memory.dmpFilesize
624KB
-
memory/3484-124-0x00000000075F0000-0x0000000007652000-memory.dmpFilesize
392KB
-
memory/3484-122-0x0000000004F60000-0x0000000004F6C000-memory.dmpFilesize
48KB
-
memory/3484-121-0x0000000004CD0000-0x00000000051CE000-memory.dmpFilesize
5.0MB
-
memory/3484-120-0x0000000004D20000-0x0000000004D2A000-memory.dmpFilesize
40KB
-
memory/3484-119-0x0000000004D70000-0x0000000004E02000-memory.dmpFilesize
584KB
-
memory/3484-117-0x0000000000480000-0x00000000004E6000-memory.dmpFilesize
408KB
-
memory/3484-118-0x00000000051D0000-0x00000000056CE000-memory.dmpFilesize
5.0MB