Analysis
-
max time kernel
173s -
max time network
184s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
29-01-2022 13:48
Static task
static1
Behavioral task
behavioral1
Sample
Nc162VSyId1HcRH.exe
Resource
win7-en-20211208
General
-
Target
Nc162VSyId1HcRH.exe
-
Size
389KB
-
MD5
01190158d9f1303cdcd3b00037dd093a
-
SHA1
07f1eca8ba4ffd276a207acbfe943dc3bb82beec
-
SHA256
9c9391787e2960bdf7769a7cdef7488571a181336110a0d70322d3a870ecf775
-
SHA512
98aa8a6b4eb8d0caf7d1bddefcdda3cdaeb38a711b6404ede7deac770bccc565880f0bda39e02faa4b56f877853c1aedde0e0810d922e2ccf6de9a52202c8dc7
Malware Config
Extracted
xloader
2.5
b3xd
nestonconstruction.com
ratnainternational.com
3bersaudara.com
scottkmoody.store
1metroband.com
prechit.com
desertbirdmercantile.com
marciabernice.com
packard.vote
selo.global
fourthandwhiteoak.com
ecoplagas.online
api-jipotvcom.xyz
shabellafurniture.com
maxmonacomarble.com
imprimiruncalendario.com
cochepordinero.net
teamosu.club
therightleftfoot.com
mitt-masters.com
transformeddestiny.com
vzyz.top
perfectotr.com
rnhapr.com
polebear.xyz
tiatapa.com
plick-click.com
losfantasticos.com
georgemacpherson.xyz
sadiknitwears.com
hpmetaverse.com
smart-life-hacks.com
gpowermall.com
codegreenautomation.com
investment-scientist.com
igthksolution.com
lrtlffnr.xyz
ecomm-hub.com
99ganbi.top
quaked.net
teliazepte.com
www24fa.top
nobleslim.com
hsbsr9s.sbs
yetiecoolerusa.com
hourly.limo
idesignuix.com
fun4freegames.com
wxqfilm.com
auburnfuid.com
chengxinyuan.online
yzztx.com
huggsforbubbs.com
cdrbk.com
eclipses.today
sigmamu.com
5pineridge.com
lowfrictionvideo.com
ord12route.art
accreditslots.com
madeitinhome.com
insurance.pink
thietkenoithatvanphong.asia
gkynykj.com
meizi.ltd
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3768-126-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3768-129-0x00000000017D0000-0x000000000196C000-memory.dmp xloader behavioral2/memory/3768-131-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4268-135-0x0000000002F40000-0x0000000002F69000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Nc162VSyId1HcRH.exeNc162VSyId1HcRH.exenetsh.exedescription pid process target process PID 3992 set thread context of 3768 3992 Nc162VSyId1HcRH.exe Nc162VSyId1HcRH.exe PID 3768 set thread context of 372 3768 Nc162VSyId1HcRH.exe Explorer.EXE PID 3768 set thread context of 372 3768 Nc162VSyId1HcRH.exe Explorer.EXE PID 4268 set thread context of 372 4268 netsh.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 38 IoCs
Processes:
Nc162VSyId1HcRH.exenetsh.exepid process 3768 Nc162VSyId1HcRH.exe 3768 Nc162VSyId1HcRH.exe 3768 Nc162VSyId1HcRH.exe 3768 Nc162VSyId1HcRH.exe 3768 Nc162VSyId1HcRH.exe 3768 Nc162VSyId1HcRH.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe 4268 netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 372 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Nc162VSyId1HcRH.exenetsh.exepid process 3768 Nc162VSyId1HcRH.exe 3768 Nc162VSyId1HcRH.exe 3768 Nc162VSyId1HcRH.exe 3768 Nc162VSyId1HcRH.exe 4268 netsh.exe 4268 netsh.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Nc162VSyId1HcRH.exenetsh.exedescription pid process Token: SeDebugPrivilege 3768 Nc162VSyId1HcRH.exe Token: SeDebugPrivilege 4268 netsh.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Nc162VSyId1HcRH.exeExplorer.EXEnetsh.exedescription pid process target process PID 3992 wrote to memory of 3768 3992 Nc162VSyId1HcRH.exe Nc162VSyId1HcRH.exe PID 3992 wrote to memory of 3768 3992 Nc162VSyId1HcRH.exe Nc162VSyId1HcRH.exe PID 3992 wrote to memory of 3768 3992 Nc162VSyId1HcRH.exe Nc162VSyId1HcRH.exe PID 3992 wrote to memory of 3768 3992 Nc162VSyId1HcRH.exe Nc162VSyId1HcRH.exe PID 3992 wrote to memory of 3768 3992 Nc162VSyId1HcRH.exe Nc162VSyId1HcRH.exe PID 3992 wrote to memory of 3768 3992 Nc162VSyId1HcRH.exe Nc162VSyId1HcRH.exe PID 372 wrote to memory of 4268 372 Explorer.EXE netsh.exe PID 372 wrote to memory of 4268 372 Explorer.EXE netsh.exe PID 372 wrote to memory of 4268 372 Explorer.EXE netsh.exe PID 4268 wrote to memory of 4280 4268 netsh.exe cmd.exe PID 4268 wrote to memory of 4280 4268 netsh.exe cmd.exe PID 4268 wrote to memory of 4280 4268 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nc162VSyId1HcRH.exe"C:\Users\Admin\AppData\Local\Temp\Nc162VSyId1HcRH.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nc162VSyId1HcRH.exe"C:\Users\Admin\AppData\Local\Temp\Nc162VSyId1HcRH.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Nc162VSyId1HcRH.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/372-138-0x0000000003360000-0x0000000003422000-memory.dmpFilesize
776KB
-
memory/372-133-0x0000000006870000-0x00000000069C8000-memory.dmpFilesize
1.3MB
-
memory/372-130-0x00000000031E0000-0x00000000032C8000-memory.dmpFilesize
928KB
-
memory/3768-126-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3768-132-0x00000000035E0000-0x00000000035F1000-memory.dmpFilesize
68KB
-
memory/3768-131-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3768-129-0x00000000017D0000-0x000000000196C000-memory.dmpFilesize
1.6MB
-
memory/3768-128-0x0000000001970000-0x0000000001C90000-memory.dmpFilesize
3.1MB
-
memory/3992-123-0x0000000005930000-0x000000000593C000-memory.dmpFilesize
48KB
-
memory/3992-125-0x0000000007F70000-0x0000000007FD2000-memory.dmpFilesize
392KB
-
memory/3992-124-0x0000000007E40000-0x0000000007EDC000-memory.dmpFilesize
624KB
-
memory/3992-118-0x0000000000D00000-0x0000000000D68000-memory.dmpFilesize
416KB
-
memory/3992-122-0x0000000005850000-0x000000000585A000-memory.dmpFilesize
40KB
-
memory/3992-121-0x0000000005640000-0x00000000056D2000-memory.dmpFilesize
584KB
-
memory/3992-120-0x0000000005750000-0x00000000057E2000-memory.dmpFilesize
584KB
-
memory/3992-119-0x0000000005C50000-0x000000000614E000-memory.dmpFilesize
5.0MB
-
memory/4268-135-0x0000000002F40000-0x0000000002F69000-memory.dmpFilesize
164KB
-
memory/4268-134-0x0000000000880000-0x000000000089E000-memory.dmpFilesize
120KB
-
memory/4268-136-0x00000000031F0000-0x0000000003510000-memory.dmpFilesize
3.1MB
-
memory/4268-137-0x00000000035A0000-0x0000000003630000-memory.dmpFilesize
576KB