Analysis
-
max time kernel
157s -
max time network
58s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
03-02-2022 08:32
Static task
static1
Behavioral task
behavioral1
Sample
tS1DhARF4HLvLA6.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
tS1DhARF4HLvLA6.exe
Resource
win10v2004-en-20220113
General
-
Target
tS1DhARF4HLvLA6.exe
-
Size
466KB
-
MD5
d88a53faab7f22298b69de606e38894c
-
SHA1
6472dc71a4b6d1cb508d22676656b99e2ee2c3f9
-
SHA256
e001e6df4c7f72792f62e8a6c85f7061589071eae796aff8c96343a25b9641f8
-
SHA512
92bfc7130b0e2fb93da0ec1bb044198d2f7b3aa8c00b878ed95f312e597542ad7c84f13bb13fca369a4412181b674f3640c1b4eea230c343a0ea27b157d7b2c0
Malware Config
Extracted
xloader
2.5
cbgo
tablescaperendezvous4two.net
abktransportllc.net
roseevision.com
skategrindingwheels.com
robux-generator-free.xyz
yacusi.com
mgav35.xyz
paravocecommerce.com
venkatramanrm.com
freakyhamster.com
jenaashoponline.com
dmozlisting.com
lorrainekclark.store
handyman-prime.com
thecrashingbrains.com
ukpms.com
livingstonemines.com
papeisonline.com
chrisbakerpr.com
omnipets.store
anatox-lab.fr
missingthered.com
himalaya-nepalorganic.com
bitcoin-bot.xyz
velarusbet78.com
redesignyourpain.com
alonetogetherentertainment.com
sandywalling.com
solacegolf.com
charlottesbestroofcompany.com
stefanybeauty.com
webarate.com
experiencedlawfirms.com
lyfygthj.com
monoicstudios.com
rgamming.com
mintique.pro
totalwinerewards.com
praelatusproducts.com
daniloff.pro
qmir.digital
tatasteell.com
casatowerofficial.com
sunrisespaandbodywork.com
mgav66.xyz
bastnbt.com
fabiulaezeca.com
sunmountainautomotive.com
madgeniustalk.com
elite-hc.com
billcurdmusic.net
foxclothings.com
adtcmrac.com
buresdx.com
tothelaundry.com
bitconga.com
onlinebiyoloji.online
up-trend.store
kaarlehto.com
interview.online
grantgroupproperties.com
jpmhomes.net
yinlimine.xyz
roadtrippings.com
cottoneworld.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/564-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/564-67-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1072-71-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 756 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tS1DhARF4HLvLA6.exetS1DhARF4HLvLA6.exedescription pid process target process PID 612 set thread context of 564 612 tS1DhARF4HLvLA6.exe tS1DhARF4HLvLA6.exe PID 564 set thread context of 1412 564 tS1DhARF4HLvLA6.exe Explorer.EXE PID 564 set thread context of 1412 564 tS1DhARF4HLvLA6.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
tS1DhARF4HLvLA6.execmmon32.exepid process 564 tS1DhARF4HLvLA6.exe 564 tS1DhARF4HLvLA6.exe 564 tS1DhARF4HLvLA6.exe 1072 cmmon32.exe 1072 cmmon32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
tS1DhARF4HLvLA6.execmmon32.exepid process 564 tS1DhARF4HLvLA6.exe 564 tS1DhARF4HLvLA6.exe 564 tS1DhARF4HLvLA6.exe 564 tS1DhARF4HLvLA6.exe 1072 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tS1DhARF4HLvLA6.execmmon32.exedescription pid process Token: SeDebugPrivilege 564 tS1DhARF4HLvLA6.exe Token: SeDebugPrivilege 1072 cmmon32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
tS1DhARF4HLvLA6.exeExplorer.EXEcmmon32.exedescription pid process target process PID 612 wrote to memory of 564 612 tS1DhARF4HLvLA6.exe tS1DhARF4HLvLA6.exe PID 612 wrote to memory of 564 612 tS1DhARF4HLvLA6.exe tS1DhARF4HLvLA6.exe PID 612 wrote to memory of 564 612 tS1DhARF4HLvLA6.exe tS1DhARF4HLvLA6.exe PID 612 wrote to memory of 564 612 tS1DhARF4HLvLA6.exe tS1DhARF4HLvLA6.exe PID 612 wrote to memory of 564 612 tS1DhARF4HLvLA6.exe tS1DhARF4HLvLA6.exe PID 612 wrote to memory of 564 612 tS1DhARF4HLvLA6.exe tS1DhARF4HLvLA6.exe PID 612 wrote to memory of 564 612 tS1DhARF4HLvLA6.exe tS1DhARF4HLvLA6.exe PID 1412 wrote to memory of 1072 1412 Explorer.EXE cmmon32.exe PID 1412 wrote to memory of 1072 1412 Explorer.EXE cmmon32.exe PID 1412 wrote to memory of 1072 1412 Explorer.EXE cmmon32.exe PID 1412 wrote to memory of 1072 1412 Explorer.EXE cmmon32.exe PID 1072 wrote to memory of 756 1072 cmmon32.exe cmd.exe PID 1072 wrote to memory of 756 1072 cmmon32.exe cmd.exe PID 1072 wrote to memory of 756 1072 cmmon32.exe cmd.exe PID 1072 wrote to memory of 756 1072 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tS1DhARF4HLvLA6.exe"C:\Users\Admin\AppData\Local\Temp\tS1DhARF4HLvLA6.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tS1DhARF4HLvLA6.exe"C:\Users\Admin\AppData\Local\Temp\tS1DhARF4HLvLA6.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tS1DhARF4HLvLA6.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/564-68-0x00000000003E0000-0x00000000003F1000-memory.dmpFilesize
68KB
-
memory/564-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/564-64-0x0000000000B10000-0x0000000000E13000-memory.dmpFilesize
3.0MB
-
memory/564-67-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/564-65-0x00000000002A0000-0x00000000002B1000-memory.dmpFilesize
68KB
-
memory/564-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/564-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/612-59-0x0000000004F60000-0x0000000004FBE000-memory.dmpFilesize
376KB
-
memory/612-57-0x00000000022A0000-0x00000000022A1000-memory.dmpFilesize
4KB
-
memory/612-56-0x0000000076921000-0x0000000076923000-memory.dmpFilesize
8KB
-
memory/612-58-0x0000000000270000-0x0000000000284000-memory.dmpFilesize
80KB
-
memory/612-55-0x0000000000900000-0x000000000097A000-memory.dmpFilesize
488KB
-
memory/1072-70-0x0000000000510000-0x000000000051D000-memory.dmpFilesize
52KB
-
memory/1072-71-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1072-72-0x0000000001F60000-0x0000000002263000-memory.dmpFilesize
3.0MB
-
memory/1412-66-0x00000000067D0000-0x00000000068D0000-memory.dmpFilesize
1024KB
-
memory/1412-69-0x0000000007200000-0x00000000072DB000-memory.dmpFilesize
876KB