Analysis
-
max time kernel
164s -
max time network
176s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
29-01-2022 14:00
Static task
static1
Behavioral task
behavioral1
Sample
SKC360I2.exe
Resource
win7-en-20211208
General
-
Target
SKC360I2.exe
-
Size
509KB
-
MD5
196b7f181400d2e97eb9579059cc900c
-
SHA1
4db7ff3d766b0fb98a6c70a4272aaf71a1a60180
-
SHA256
9343e815779a3b9b9520e1f781b89a20d1a7a961e56cb98e266880b7ab9e8f93
-
SHA512
e64427df89db6a971c453ad481477e78632732c3ca7b1b544324fc9ccb1e00a6d830879ff0408adefeff7f28cd5e3308f4c3f2a34f34a3e2334080de8489d6fa
Malware Config
Extracted
xloader
2.5
u0n0
learnwithvr.net
minismi2.com
slimfitbottle.com
gzartisan.com
fullfamilyclub.com
adaptationstudios.com
domynt.com
aboydnfuid.com
dirtroaddesigns.net
timhortons-ca.xyz
gladiator-111.com
breakingza.com
njjbds.com
keithrgordon.com
litestore365.host
unichromegame.com
wundversorgung-tirol.com
wholistic-choice.com
shingletownrrn.com
kapikenya.com
kermmehienon.quest
harunowellness.com
avrknastyrke.quest
mpujadas.com
bonbyk.xyz
twozilla.com
abrahamguestacademy.com
canwasysce.com
cangshu76.xyz
clinicadeconsultanta.com
fazdesignmalta.com
localcommunityspace.com
subdlt.com
gothambody.net
tongtongticket.com
giadinhmarket.xyz
jessaniholdings.com
sebika.com
infinitygamesonline.net
denton4.com
ctenemuhos.quest
governerdsummerfun.com
69988.club
2pnlx3.biz
radhikamobilerajasen.online
myborntoshare.com
mdkfsdf.info
dj6688a.com
feelinthorny.com
minimart.digital
offprize.xyz
niallsinclair.com
iclouds.today
xn--80ajy8a.xn--80asehdb
marionutrishop.com
yanglaowenku.com
youngmotorist.com
unavidaparaserfeliz.com
linknhomkin.com
webwarez.net
sabrinaxmendes.com
nurix.agency
bancosabadellnow.com
totalpopsociety.com
52xjg3.xyz
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/8-126-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1400-132-0x00000000033B0000-0x00000000033D9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SKC360I2.exeSKC360I2.execscript.exedescription pid process target process PID 2476 set thread context of 8 2476 SKC360I2.exe SKC360I2.exe PID 8 set thread context of 2472 8 SKC360I2.exe Explorer.EXE PID 1400 set thread context of 2472 1400 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
SKC360I2.exeSKC360I2.execscript.exepid process 2476 SKC360I2.exe 2476 SKC360I2.exe 2476 SKC360I2.exe 2476 SKC360I2.exe 8 SKC360I2.exe 8 SKC360I2.exe 8 SKC360I2.exe 8 SKC360I2.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe 1400 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2472 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
SKC360I2.execscript.exepid process 8 SKC360I2.exe 8 SKC360I2.exe 8 SKC360I2.exe 1400 cscript.exe 1400 cscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SKC360I2.exeSKC360I2.execscript.exedescription pid process Token: SeDebugPrivilege 2476 SKC360I2.exe Token: SeDebugPrivilege 8 SKC360I2.exe Token: SeDebugPrivilege 1400 cscript.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
SKC360I2.exeExplorer.EXEcscript.exedescription pid process target process PID 2476 wrote to memory of 3416 2476 SKC360I2.exe SKC360I2.exe PID 2476 wrote to memory of 3416 2476 SKC360I2.exe SKC360I2.exe PID 2476 wrote to memory of 3416 2476 SKC360I2.exe SKC360I2.exe PID 2476 wrote to memory of 3064 2476 SKC360I2.exe SKC360I2.exe PID 2476 wrote to memory of 3064 2476 SKC360I2.exe SKC360I2.exe PID 2476 wrote to memory of 3064 2476 SKC360I2.exe SKC360I2.exe PID 2476 wrote to memory of 8 2476 SKC360I2.exe SKC360I2.exe PID 2476 wrote to memory of 8 2476 SKC360I2.exe SKC360I2.exe PID 2476 wrote to memory of 8 2476 SKC360I2.exe SKC360I2.exe PID 2476 wrote to memory of 8 2476 SKC360I2.exe SKC360I2.exe PID 2476 wrote to memory of 8 2476 SKC360I2.exe SKC360I2.exe PID 2476 wrote to memory of 8 2476 SKC360I2.exe SKC360I2.exe PID 2472 wrote to memory of 1400 2472 Explorer.EXE cscript.exe PID 2472 wrote to memory of 1400 2472 Explorer.EXE cscript.exe PID 2472 wrote to memory of 1400 2472 Explorer.EXE cscript.exe PID 1400 wrote to memory of 612 1400 cscript.exe cmd.exe PID 1400 wrote to memory of 612 1400 cscript.exe cmd.exe PID 1400 wrote to memory of 612 1400 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SKC360I2.exe"C:\Users\Admin\AppData\Local\Temp\SKC360I2.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SKC360I2.exe"C:\Users\Admin\AppData\Local\Temp\SKC360I2.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SKC360I2.exe"C:\Users\Admin\AppData\Local\Temp\SKC360I2.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SKC360I2.exe"C:\Users\Admin\AppData\Local\Temp\SKC360I2.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SKC360I2.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/8-126-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/8-129-0x0000000001820000-0x00000000019BF000-memory.dmpFilesize
1.6MB
-
memory/8-128-0x00000000019C0000-0x0000000001CE0000-memory.dmpFilesize
3.1MB
-
memory/1400-131-0x0000000001210000-0x0000000001237000-memory.dmpFilesize
156KB
-
memory/1400-134-0x0000000004E40000-0x0000000004ED0000-memory.dmpFilesize
576KB
-
memory/1400-133-0x0000000004A90000-0x0000000004DB0000-memory.dmpFilesize
3.1MB
-
memory/1400-132-0x00000000033B0000-0x00000000033D9000-memory.dmpFilesize
164KB
-
memory/2472-130-0x00000000064B0000-0x00000000065E5000-memory.dmpFilesize
1.2MB
-
memory/2472-135-0x0000000002C50000-0x0000000002D41000-memory.dmpFilesize
964KB
-
memory/2476-125-0x0000000005A90000-0x0000000005AE0000-memory.dmpFilesize
320KB
-
memory/2476-119-0x0000000005240000-0x000000000573E000-memory.dmpFilesize
5.0MB
-
memory/2476-120-0x0000000004D40000-0x0000000004DD2000-memory.dmpFilesize
584KB
-
memory/2476-118-0x0000000000460000-0x00000000004E4000-memory.dmpFilesize
528KB
-
memory/2476-121-0x0000000004D40000-0x000000000523E000-memory.dmpFilesize
5.0MB
-
memory/2476-122-0x0000000004D10000-0x0000000004D1A000-memory.dmpFilesize
40KB
-
memory/2476-124-0x0000000005AE0000-0x0000000005B7C000-memory.dmpFilesize
624KB
-
memory/2476-123-0x0000000005180000-0x000000000518C000-memory.dmpFilesize
48KB