Analysis
- max time kernel
184s - max time network
200s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
08/02/2022, 03:21
Static task
static1
Behavioral task
behavioral1
Sample
5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target 5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe
- Size 864KB
- Sample220208-dwf7hacefl
- SHA256 5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489
- MD5 c1a77dddf52f12af022d82471e6bdf19
- SHA1 c39c5f47d73dd8a0b7fd2ebaad7a7b57a92d0ea0
- SHA512 b0825bccffaa39791d19919f0ae3f95f384c9da6aad24f50d3623267da266ddde95eb7f0d3777e33cc013a0fe770230a8e03501b7b32d1834528b61af14b60cb
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.3
Campaign
-
uidr
Decoy
-
dulichsongcham.com
-
cash-royal.com
-
geneseewildlifetrapping.com
-
9cc9x79m3y2.com
-
ntjjzx.com
-
joinglooko.com
-
upmchealhtrak.com
-
hookandcask.com
-
orca-web.com
-
ag3holdings.com
-
empoweredinvestmentstx.com
-
lustywall.com
-
rcpelaurentides.com
-
goyalcoorchidnirvanatwo.homes
-
iotajinn.com
-
littlemlive.com
-
hippocratesbio.com
-
ashleysema.design
-
175a45.xyz
-
bpocompaniesphilippines.com
-
leadmorecommunity.com
-
mrbobscleaning.com
-
newdistributorbbc.com
-
lxhfzy.com
-
physicianrepresentative.com
-
integrative-teletherapy.com
-
selllasheswithla.com
-
dbxff.com
-
pinewayorganics.com
-
bepongbeo.com
-
dbrulhart.com
-
thereallynicepeople.com
-
kakilangit.net
-
mndesignw.com
-
send86cells.com
-
gakkard.com
-
blacktiers.com
-
2603083932.xyz
-
tailoredlacedwigs.com
-
gaypridebusinessdirectory.com
-
cowbex.info
-
lakecharlestreeservices.com
-
4tza1.com
-
rimlyane.com
-
babadoes.com
-
missteenagerworld.com
-
womenreadytomove.com
-
connectingdaybyday.com
-
paygss.net
-
cachavachaayd.com
-
xn--80aaatqunmdeu5n.xn--p1acf
-
zxr.xyz
-
baignoire.sucks
-
analystsguild.com
-
60ro9e.com
-
goplaytolearn.com
-
virtualcarerehab.wiki
-
fschaogang.com
-
181215.com
-
theinlandempirelifestyle.com
-
laluccasa.com
-
bflat-store.com
-
frontrangespiceco.com
-
carrierocommerical.com
-
ios.run
Signatures
- Xloader Payload 1 IoCs
resource yara_rule behavioral2/memory/1884-141-0x0000000000400000-0x0000000000428000-memory.dmp xloader - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1556 set thread context of 1884 1556 5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe 102 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1556 5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe 1556 5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe 1884 5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe 1884 5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4180 svchost.exe Token: SeCreatePagefilePrivilege 4180 svchost.exe Token: SeShutdownPrivilege 4180 svchost.exe Token: SeCreatePagefilePrivilege 4180 svchost.exe Token: SeShutdownPrivilege 4180 svchost.exe Token: SeCreatePagefilePrivilege 4180 svchost.exe Token: SeSecurityPrivilege 1284 TiWorker.exe Token: SeRestorePrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe Token: SeRestorePrivilege 1284 TiWorker.exe Token: SeSecurityPrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe Token: SeRestorePrivilege 1284 TiWorker.exe Token: SeSecurityPrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe Token: SeRestorePrivilege 1284 TiWorker.exe Token: SeSecurityPrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe Token: SeRestorePrivilege 1284 TiWorker.exe Token: SeSecurityPrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe Token: SeRestorePrivilege 1284 TiWorker.exe Token: SeSecurityPrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe Token: SeRestorePrivilege 1284 TiWorker.exe Token: SeSecurityPrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe Token: SeRestorePrivilege 1284 TiWorker.exe Token: SeSecurityPrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe Token: SeRestorePrivilege 1284 TiWorker.exe Token: SeSecurityPrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe Token: SeRestorePrivilege 1284 TiWorker.exe Token: SeSecurityPrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe Token: SeRestorePrivilege 1284 TiWorker.exe Token: SeSecurityPrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe Token: SeRestorePrivilege 1284 TiWorker.exe Token: SeSecurityPrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe Token: SeRestorePrivilege 1284 TiWorker.exe Token: SeSecurityPrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe Token: SeRestorePrivilege 1284 TiWorker.exe Token: SeSecurityPrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe Token: SeRestorePrivilege 1284 TiWorker.exe Token: SeSecurityPrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe Token: SeRestorePrivilege 1284 TiWorker.exe Token: SeSecurityPrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe Token: SeRestorePrivilege 1284 TiWorker.exe Token: SeSecurityPrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe Token: SeRestorePrivilege 1284 TiWorker.exe Token: SeSecurityPrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe Token: SeRestorePrivilege 1284 TiWorker.exe Token: SeSecurityPrivilege 1284 TiWorker.exe Token: SeBackupPrivilege 1284 TiWorker.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1556 wrote to memory of 3528 1556 5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe 101 PID 1556 wrote to memory of 3528 1556 5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe 101 PID 1556 wrote to memory of 3528 1556 5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe 101 PID 1556 wrote to memory of 1884 1556 5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe 102 PID 1556 wrote to memory of 1884 1556 5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe 102 PID 1556 wrote to memory of 1884 1556 5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe 102 PID 1556 wrote to memory of 1884 1556 5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe 102 PID 1556 wrote to memory of 1884 1556 5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe 102 PID 1556 wrote to memory of 1884 1556 5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe"C:\Users\Admin\AppData\Local\Temp\5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe"C:\Users\Admin\AppData\Local\Temp\5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe"2⤵PID:3528
-
-
C:\Users\Admin\AppData\Local\Temp\5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe"C:\Users\Admin\AppData\Local\Temp\5528ee96b8cefda8ec99999701a1673fb0dff17a8e603f2c8ccd3abac08f7489.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1884
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4180
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1284