Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
22-02-2022 15:37
Static task
static1
Behavioral task
behavioral1
Sample
7t98b0nkQlBODdw.exe
Resource
win7-en-20211208
General
-
Target
7t98b0nkQlBODdw.exe
-
Size
1.0MB
-
MD5
0466190246cd2f51a7784d53820242ac
-
SHA1
f85c141f0d77f97ffea3af67866e1b311c2fb7bb
-
SHA256
873dbebeb40efa109a634b2ca2cb3faeae658dae5c19b518f4769c6dd65f4d38
-
SHA512
1f07df02ce04c07b1f94ebdf8095d1a4358059761f274b044acddc1bdf0d1145d9a40a2d7dbd499cec5a950d6bea6765b4a98f923ec2a84a0aff3972373e8e9e
Malware Config
Extracted
xloader
2.5
wdc8
mygotomaid.com
joyoushealthandwellnessspa.com
wefundprojects.com
magicbasketbourse.net
vitos3.xyz
oligopoly.city
beauty-bihada.asia
visitnewrichmond.com
crgeniusworld.biz
bantasis.com
transsexual.pro
casagraph.com
eastjamrecords.com
howtotrainyourmustache.com
heiappropriate.xyz
bataperu.com
ces341.com
prajahitha.com
manuelagattegger.com
wolfpackmotorcycletours.com
yulietrojas.com
dariven.com
dd13thsept.net
kalpeshvasoya.com
theavarosecollection.com
bloody-randoms.com
yngo-arca.com
dealsoffer.xyz
marellaweddingplanner.com
seowongoopain.com
omightygod.com
dqblog.net
thethreadedbrow.com
medflex.center
filpify.com
chaletxp.com
santanderburge.com
171341.com
shannongroves.com
sisoow.quest
harleybowd.com
cardioflextech.com
exspv.com
permianbasinautismacademy.info
gardenchipvip.com
onsitemarketingsolutions.com
cvwerg.com
theketocopywriter.com
telarte-ceramicas.com
j2ig529zbahs.biz
oxygenii.com
extralegally.info
hbdlaq.com
themountainkings.com
fibliz.com
skyrangersfoundation.com
forbabylon.net
weilaiyitj.com
supplementstoreryp.com
thehappyartnook.com
houzzcoin.com
heyitsnew.com
jonnystokes.com
venuesgrantprogram.com
hamiltonrealestate.online
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1740-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1740-64-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1160-70-0x00000000000C0000-0x00000000000E9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1880 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
7t98b0nkQlBODdw.exe7t98b0nkQlBODdw.exewlanext.exedescription pid process target process PID 1052 set thread context of 1740 1052 7t98b0nkQlBODdw.exe 7t98b0nkQlBODdw.exe PID 1740 set thread context of 1220 1740 7t98b0nkQlBODdw.exe Explorer.EXE PID 1160 set thread context of 1220 1160 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
7t98b0nkQlBODdw.exewlanext.exepid process 1740 7t98b0nkQlBODdw.exe 1740 7t98b0nkQlBODdw.exe 1160 wlanext.exe 1160 wlanext.exe 1160 wlanext.exe 1160 wlanext.exe 1160 wlanext.exe 1160 wlanext.exe 1160 wlanext.exe 1160 wlanext.exe 1160 wlanext.exe 1160 wlanext.exe 1160 wlanext.exe 1160 wlanext.exe 1160 wlanext.exe 1160 wlanext.exe 1160 wlanext.exe 1160 wlanext.exe 1160 wlanext.exe 1160 wlanext.exe 1160 wlanext.exe 1160 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
7t98b0nkQlBODdw.exewlanext.exepid process 1740 7t98b0nkQlBODdw.exe 1740 7t98b0nkQlBODdw.exe 1740 7t98b0nkQlBODdw.exe 1160 wlanext.exe 1160 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7t98b0nkQlBODdw.exewlanext.exedescription pid process Token: SeDebugPrivilege 1740 7t98b0nkQlBODdw.exe Token: SeDebugPrivilege 1160 wlanext.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of SendNotifyMessage 55 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
7t98b0nkQlBODdw.exeExplorer.EXEwlanext.exedescription pid process target process PID 1052 wrote to memory of 1740 1052 7t98b0nkQlBODdw.exe 7t98b0nkQlBODdw.exe PID 1052 wrote to memory of 1740 1052 7t98b0nkQlBODdw.exe 7t98b0nkQlBODdw.exe PID 1052 wrote to memory of 1740 1052 7t98b0nkQlBODdw.exe 7t98b0nkQlBODdw.exe PID 1052 wrote to memory of 1740 1052 7t98b0nkQlBODdw.exe 7t98b0nkQlBODdw.exe PID 1052 wrote to memory of 1740 1052 7t98b0nkQlBODdw.exe 7t98b0nkQlBODdw.exe PID 1052 wrote to memory of 1740 1052 7t98b0nkQlBODdw.exe 7t98b0nkQlBODdw.exe PID 1052 wrote to memory of 1740 1052 7t98b0nkQlBODdw.exe 7t98b0nkQlBODdw.exe PID 1220 wrote to memory of 1160 1220 Explorer.EXE wlanext.exe PID 1220 wrote to memory of 1160 1220 Explorer.EXE wlanext.exe PID 1220 wrote to memory of 1160 1220 Explorer.EXE wlanext.exe PID 1220 wrote to memory of 1160 1220 Explorer.EXE wlanext.exe PID 1160 wrote to memory of 1880 1160 wlanext.exe cmd.exe PID 1160 wrote to memory of 1880 1160 wlanext.exe cmd.exe PID 1160 wrote to memory of 1880 1160 wlanext.exe cmd.exe PID 1160 wrote to memory of 1880 1160 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7t98b0nkQlBODdw.exe"C:\Users\Admin\AppData\Local\Temp\7t98b0nkQlBODdw.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7t98b0nkQlBODdw.exe"C:\Users\Admin\AppData\Local\Temp\7t98b0nkQlBODdw.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\7t98b0nkQlBODdw.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1052-54-0x00000000000C0000-0x00000000001CC000-memory.dmpFilesize
1.0MB
-
memory/1052-55-0x000000007387E000-0x000000007387F000-memory.dmpFilesize
4KB
-
memory/1052-56-0x00000000003F0000-0x0000000000400000-memory.dmpFilesize
64KB
-
memory/1052-57-0x00000000074A0000-0x00000000074A1000-memory.dmpFilesize
4KB
-
memory/1052-58-0x0000000007AA0000-0x0000000007B4E000-memory.dmpFilesize
696KB
-
memory/1052-59-0x0000000000800000-0x0000000000830000-memory.dmpFilesize
192KB
-
memory/1160-70-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/1160-69-0x0000000000C00000-0x0000000000C16000-memory.dmpFilesize
88KB
-
memory/1160-73-0x0000000000880000-0x0000000000910000-memory.dmpFilesize
576KB
-
memory/1160-72-0x00000000754B1000-0x00000000754B3000-memory.dmpFilesize
8KB
-
memory/1160-71-0x0000000002020000-0x0000000002323000-memory.dmpFilesize
3.0MB
-
memory/1220-74-0x00000000041B0000-0x0000000004257000-memory.dmpFilesize
668KB
-
memory/1220-66-0x0000000004EE0000-0x000000000504E000-memory.dmpFilesize
1.4MB
-
memory/1740-64-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1740-68-0x0000000000230000-0x0000000000241000-memory.dmpFilesize
68KB
-
memory/1740-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1740-67-0x00000000009A0000-0x0000000000CA3000-memory.dmpFilesize
3.0MB
-
memory/1740-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1740-65-0x000000000041D000-0x000000000041E000-memory.dmpFilesize
4KB
-
memory/1740-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB