Analysis
-
max time kernel
153s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 12:43
Static task
static1
Behavioral task
behavioral1
Sample
tlBHrCrteFXy8Jz.exe
Resource
win7-en-20211208
General
-
Target
tlBHrCrteFXy8Jz.exe
-
Size
775KB
-
MD5
0e9943c0e2afaf5e9acec16ce184b444
-
SHA1
dc1c5f809a3e6e9a3358878d455cb235d2245460
-
SHA256
dc368951f1df68a92c51f9afe6ad73c717b040fb9af6a278e9201b176362ed70
-
SHA512
a7a7e54dc8a144266447b8c500a02adb2dcd855224f8780c6fbfe573ca3eedd1e78ab998aaa4adcfb1f717d670159b93d13cb340e2601fc936d0cc417b78eb50
Malware Config
Extracted
xloader
2.5
b3xd
nestonconstruction.com
ratnainternational.com
3bersaudara.com
scottkmoody.store
1metroband.com
prechit.com
desertbirdmercantile.com
marciabernice.com
packard.vote
selo.global
fourthandwhiteoak.com
ecoplagas.online
api-jipotvcom.xyz
shabellafurniture.com
maxmonacomarble.com
imprimiruncalendario.com
cochepordinero.net
teamosu.club
therightleftfoot.com
mitt-masters.com
transformeddestiny.com
vzyz.top
perfectotr.com
rnhapr.com
polebear.xyz
tiatapa.com
plick-click.com
losfantasticos.com
georgemacpherson.xyz
sadiknitwears.com
hpmetaverse.com
smart-life-hacks.com
gpowermall.com
codegreenautomation.com
investment-scientist.com
igthksolution.com
lrtlffnr.xyz
ecomm-hub.com
99ganbi.top
quaked.net
teliazepte.com
www24fa.top
nobleslim.com
hsbsr9s.sbs
yetiecoolerusa.com
hourly.limo
idesignuix.com
fun4freegames.com
wxqfilm.com
auburnfuid.com
chengxinyuan.online
yzztx.com
huggsforbubbs.com
cdrbk.com
eclipses.today
sigmamu.com
5pineridge.com
lowfrictionvideo.com
ord12route.art
accreditslots.com
madeitinhome.com
insurance.pink
thietkenoithatvanphong.asia
gkynykj.com
meizi.ltd
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1208-123-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1208-126-0x0000000000D00000-0x0000000000DAE000-memory.dmp xloader behavioral2/memory/3996-129-0x0000000002D90000-0x0000000002DB9000-memory.dmp xloader behavioral2/memory/3996-131-0x0000000004BB0000-0x0000000004D45000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tlBHrCrteFXy8Jz.exetlBHrCrteFXy8Jz.execontrol.exedescription pid process target process PID 2732 set thread context of 1208 2732 tlBHrCrteFXy8Jz.exe tlBHrCrteFXy8Jz.exe PID 1208 set thread context of 2720 1208 tlBHrCrteFXy8Jz.exe Explorer.EXE PID 3996 set thread context of 2720 3996 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
tlBHrCrteFXy8Jz.execontrol.exepid process 1208 tlBHrCrteFXy8Jz.exe 1208 tlBHrCrteFXy8Jz.exe 1208 tlBHrCrteFXy8Jz.exe 1208 tlBHrCrteFXy8Jz.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe 3996 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2720 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
tlBHrCrteFXy8Jz.execontrol.exepid process 1208 tlBHrCrteFXy8Jz.exe 1208 tlBHrCrteFXy8Jz.exe 1208 tlBHrCrteFXy8Jz.exe 3996 control.exe 3996 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tlBHrCrteFXy8Jz.execontrol.exedescription pid process Token: SeDebugPrivilege 1208 tlBHrCrteFXy8Jz.exe Token: SeDebugPrivilege 3996 control.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
tlBHrCrteFXy8Jz.exeExplorer.EXEcontrol.exedescription pid process target process PID 2732 wrote to memory of 1208 2732 tlBHrCrteFXy8Jz.exe tlBHrCrteFXy8Jz.exe PID 2732 wrote to memory of 1208 2732 tlBHrCrteFXy8Jz.exe tlBHrCrteFXy8Jz.exe PID 2732 wrote to memory of 1208 2732 tlBHrCrteFXy8Jz.exe tlBHrCrteFXy8Jz.exe PID 2732 wrote to memory of 1208 2732 tlBHrCrteFXy8Jz.exe tlBHrCrteFXy8Jz.exe PID 2732 wrote to memory of 1208 2732 tlBHrCrteFXy8Jz.exe tlBHrCrteFXy8Jz.exe PID 2732 wrote to memory of 1208 2732 tlBHrCrteFXy8Jz.exe tlBHrCrteFXy8Jz.exe PID 2720 wrote to memory of 3996 2720 Explorer.EXE control.exe PID 2720 wrote to memory of 3996 2720 Explorer.EXE control.exe PID 2720 wrote to memory of 3996 2720 Explorer.EXE control.exe PID 3996 wrote to memory of 3264 3996 control.exe cmd.exe PID 3996 wrote to memory of 3264 3996 control.exe cmd.exe PID 3996 wrote to memory of 3264 3996 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tlBHrCrteFXy8Jz.exe"C:\Users\Admin\AppData\Local\Temp\tlBHrCrteFXy8Jz.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tlBHrCrteFXy8Jz.exe"C:\Users\Admin\AppData\Local\Temp\tlBHrCrteFXy8Jz.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tlBHrCrteFXy8Jz.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1208-123-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1208-126-0x0000000000D00000-0x0000000000DAE000-memory.dmpFilesize
696KB
-
memory/1208-125-0x00000000013E0000-0x0000000001700000-memory.dmpFilesize
3.1MB
-
memory/2720-132-0x0000000002FE0000-0x000000000309F000-memory.dmpFilesize
764KB
-
memory/2720-127-0x0000000006830000-0x00000000069AC000-memory.dmpFilesize
1.5MB
-
memory/2732-119-0x0000000004C30000-0x0000000004C3A000-memory.dmpFilesize
40KB
-
memory/2732-121-0x0000000007630000-0x00000000076CC000-memory.dmpFilesize
624KB
-
memory/2732-122-0x00000000078B0000-0x000000000790E000-memory.dmpFilesize
376KB
-
memory/2732-120-0x0000000005170000-0x000000000517C000-memory.dmpFilesize
48KB
-
memory/2732-115-0x00000000001E0000-0x00000000002AA000-memory.dmpFilesize
808KB
-
memory/2732-118-0x0000000004BB0000-0x0000000004C42000-memory.dmpFilesize
584KB
-
memory/2732-117-0x0000000004CB0000-0x0000000004D42000-memory.dmpFilesize
584KB
-
memory/2732-116-0x00000000051B0000-0x00000000056AE000-memory.dmpFilesize
5.0MB
-
memory/3996-128-0x0000000000C80000-0x0000000000CA0000-memory.dmpFilesize
128KB
-
memory/3996-130-0x0000000004EF0000-0x0000000005210000-memory.dmpFilesize
3.1MB
-
memory/3996-129-0x0000000002D90000-0x0000000002DB9000-memory.dmpFilesize
164KB
-
memory/3996-131-0x0000000004BB0000-0x0000000004D45000-memory.dmpFilesize
1.6MB