Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
28-02-2022 15:55
Static task
static1
Behavioral task
behavioral1
Sample
banco_transferencia0280222.exe
Resource
win7-20220223-en
General
-
Target
banco_transferencia0280222.exe
-
Size
54KB
-
MD5
75c063f3e5bc2c6d22d69808c5f05f23
-
SHA1
2ed397d5b902e367bae3f07848c258b63f669997
-
SHA256
6f0508408689f77795e27f5320115355744c6b7d02cf59197dae8646bc73f267
-
SHA512
6a4c3d048ee62edd468a510bab0657b5ef9a33b86c5005efaa8794358ceb3fa9ab986da63edd38cae0197264a82c6b1b4635d5cf400fc9111cc6eda4e5c6b9dc
Malware Config
Extracted
xloader
2.5
uar3
jogoreviravolta.com
keysine.com
sami60.com
morganators.com
referral.directory
campdiscount.info
vanwah.com
jmtmjz.com
der-transformationscode.com
evangelvalormedia.com
bedsidehomecare.com
novaair.net
privilegetroissecurity.com
elsiepupz.com
yy77kk.com
nt-renewable.com
alyaqoutalabyadhautoparts.com
start-play-now.com
myskew.com
himalaya-finance.com
purwojati.com
freedomteaminc.com
byaliciafryearson.com
robocats.xyz
eumjugamu.net
bestofverona.guide
aeropatrol.net
nikisankala.com
klassociates.info
centroimprenta.xyz
xn--pckwb0cye6947ajzku8opzi.com
wasserstoff-station.net
finpro.tech
hydrocheats.com
theapplewatchdoctor.com
awridahmed.com
barrcoplumbingsupply.com
nbhard.com
32342240.xyz
photo.fail
rebornmkt.com
gzfs158.com
db-propertygroup.com
krpano.pro
globalsovereignbank.com
moonshot.properties
adanary.com
collegesecurityroadshow.net
ddsadvocacia.com
seo-python.com
5gjpu.xyz
riskprotek.com
luckbim.com
theperfecttrainer.com
taxyragl.website
ban-click.com
mystore.guide
katchybugonsale.com
chinadqwx.com
e-scooters.frl
hentainftxxx.com
52zf.icu
dbhong.com
escortworks.xyz
czzhudi.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3808-137-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3808-143-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3656-148-0x0000000000F30000-0x0000000000F59000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 43 3656 msiexec.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
banco_transferencia0280222.exebanco_transferencia0280222.exemsiexec.exedescription pid process target process PID 4440 set thread context of 3808 4440 banco_transferencia0280222.exe banco_transferencia0280222.exe PID 3808 set thread context of 1552 3808 banco_transferencia0280222.exe Explorer.EXE PID 3808 set thread context of 1552 3808 banco_transferencia0280222.exe Explorer.EXE PID 3656 set thread context of 1552 3656 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
banco_transferencia0280222.exebanco_transferencia0280222.exemsiexec.exepid process 4440 banco_transferencia0280222.exe 4440 banco_transferencia0280222.exe 3808 banco_transferencia0280222.exe 3808 banco_transferencia0280222.exe 3808 banco_transferencia0280222.exe 3808 banco_transferencia0280222.exe 3808 banco_transferencia0280222.exe 3808 banco_transferencia0280222.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe 3656 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1552 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
banco_transferencia0280222.exemsiexec.exepid process 3808 banco_transferencia0280222.exe 3808 banco_transferencia0280222.exe 3808 banco_transferencia0280222.exe 3808 banco_transferencia0280222.exe 3656 msiexec.exe 3656 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
banco_transferencia0280222.exebanco_transferencia0280222.exemsiexec.exedescription pid process Token: SeDebugPrivilege 4440 banco_transferencia0280222.exe Token: SeDebugPrivilege 3808 banco_transferencia0280222.exe Token: SeDebugPrivilege 3656 msiexec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
banco_transferencia0280222.exeExplorer.EXEmsiexec.exedescription pid process target process PID 4440 wrote to memory of 3808 4440 banco_transferencia0280222.exe banco_transferencia0280222.exe PID 4440 wrote to memory of 3808 4440 banco_transferencia0280222.exe banco_transferencia0280222.exe PID 4440 wrote to memory of 3808 4440 banco_transferencia0280222.exe banco_transferencia0280222.exe PID 4440 wrote to memory of 3808 4440 banco_transferencia0280222.exe banco_transferencia0280222.exe PID 4440 wrote to memory of 3808 4440 banco_transferencia0280222.exe banco_transferencia0280222.exe PID 4440 wrote to memory of 3808 4440 banco_transferencia0280222.exe banco_transferencia0280222.exe PID 1552 wrote to memory of 3656 1552 Explorer.EXE msiexec.exe PID 1552 wrote to memory of 3656 1552 Explorer.EXE msiexec.exe PID 1552 wrote to memory of 3656 1552 Explorer.EXE msiexec.exe PID 3656 wrote to memory of 3672 3656 msiexec.exe cmd.exe PID 3656 wrote to memory of 3672 3656 msiexec.exe cmd.exe PID 3656 wrote to memory of 3672 3656 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\banco_transferencia0280222.exe"C:\Users\Admin\AppData\Local\Temp\banco_transferencia0280222.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\banco_transferencia0280222.exeC:\Users\Admin\AppData\Local\Temp\banco_transferencia0280222.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\banco_transferencia0280222.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1552-142-0x00000000026C0000-0x000000000277E000-memory.dmpFilesize
760KB
-
memory/1552-151-0x0000000008030000-0x0000000008147000-memory.dmpFilesize
1.1MB
-
memory/1552-146-0x0000000007B20000-0x0000000007C4E000-memory.dmpFilesize
1.2MB
-
memory/3656-150-0x0000000002E50000-0x0000000002EE0000-memory.dmpFilesize
576KB
-
memory/3656-149-0x0000000002FF0000-0x000000000333A000-memory.dmpFilesize
3.3MB
-
memory/3656-148-0x0000000000F30000-0x0000000000F59000-memory.dmpFilesize
164KB
-
memory/3656-147-0x00000000009E0000-0x00000000009F2000-memory.dmpFilesize
72KB
-
memory/3808-141-0x0000000001D00000-0x0000000001D11000-memory.dmpFilesize
68KB
-
memory/3808-145-0x0000000003640000-0x0000000003651000-memory.dmpFilesize
68KB
-
memory/3808-140-0x000000000041D000-0x000000000041E000-memory.dmpFilesize
4KB
-
memory/3808-139-0x00000000018D0000-0x0000000001C1A000-memory.dmpFilesize
3.3MB
-
memory/3808-137-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3808-143-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3808-144-0x000000000041D000-0x000000000041E000-memory.dmpFilesize
4KB
-
memory/4440-130-0x000000007506E000-0x000000007506F000-memory.dmpFilesize
4KB
-
memory/4440-136-0x000000000B8E0000-0x000000000B972000-memory.dmpFilesize
584KB
-
memory/4440-135-0x000000000BE90000-0x000000000C434000-memory.dmpFilesize
5.6MB
-
memory/4440-134-0x000000000B820000-0x000000000B8D2000-memory.dmpFilesize
712KB
-
memory/4440-133-0x000000000B710000-0x000000000B760000-memory.dmpFilesize
320KB
-
memory/4440-132-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/4440-131-0x0000000000740000-0x0000000000754000-memory.dmpFilesize
80KB