Analysis
- max time kernel
1806s - max time network
1812s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
14/03/2022, 13:56
Static task
static1
Behavioral task
behavioral1
Sample
PO0530322.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
General
- Target PO0530322.exe
- Size 828KB
- Sample220314-q8v8eagbd4
- SHA256 511cfaacb35df2a07aca55efb2b27b6a557e210cb5ae1d31914336f39fc472e8
- MD5 3571acd11c863c2ba7e140f2c953c631
- SHA1 e39344f01dcabe5e456e6aee7d71a7e47107d431
- SHA512 bba895b2292c841f4cc0b09117846f2118d659db6f193bf1c3cabcabb501c3395e699ae6e1ae1878d16d1058f9eb47abda827a574024afaa84d1c27e95caccee
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
emn5
Decoy
-
clayexoticsatl.com
-
nezano.com
-
canacomagdalena.com
-
albawardl.com
-
dayinsuzhou.com
-
systdz.com
-
medievaliasabadell.com
-
brentkharper.store
-
aanvullend-protocol.xyz
-
ritebet388.com
-
kawaiim.com
-
laxwild.com
-
ilovemakingwebsites.com
-
joindowntown.com
-
car-tech.tech
-
ashcm.com
-
kryptolawyers.com
-
atasteofcali.com
-
isiachalsie.quest
-
marthaperry.com
-
gastrotradicional.online
-
hexicansforhire.com
-
cameronmckay.com
-
youngvan.com
-
xn--vhqsn66ilylvi8b.xn--czru2d
-
goldenpupssale.com
-
hotboymarket.com
-
pedorc.com
-
gsibralstar1.com
-
334131.com
-
193351.com
-
replanlegal-p.store
-
cherejeanne.com
-
bulkprices.info
-
positivethingsbymarion.com
-
redash-test.net
-
daoshushipian.com
-
vineethkandukuri.xyz
-
bauchgefuehl.care
-
alphaore.com
-
acskitchens.com
-
gmelectro7.com
-
influxair.com
-
isaiahnwokobia.com
-
heavenlykreationsandscentz.com
-
uhez.space
-
accountaxfiling.com
-
1stcoastjax.com
-
brightsandstudios.com
-
ecohomecompare.com
-
8k8k888.com
-
carenowindia.care
-
jddepew.com
-
4communit.com
-
naiduteja049.info
-
thewarrenreport.net
-
autoparts-gz.com
-
sistemazeusplay.com
-
pullthroughgroup.com
-
xbcsy.com
-
lpyan.com
-
thisflippingfamily.com
-
indigovar.com
-
gabriglentleyri.xyz
-
tuvee.net
Signatures
- Xloader Payload 3 IoCs
resource yara_rule behavioral2/memory/4852-141-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4852-143-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3516-149-0x00000000003D0000-0x00000000003F9000-memory.dmp xloader - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run raserver.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Q2KDWRLPO8 = "C:\\Program Files (x86)\\Ja8bxnt\\uroljornhr.exe" raserver.exe - Executes dropped EXE 2 IoCs
pid Process 1596 uroljornhr.exe 1504 uroljornhr.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4516 set thread context of 4852 4516 PO0530322.exe 90 PID 4852 set thread context of 2776 4852 PO0530322.exe 51 PID 3516 set thread context of 2776 3516 raserver.exe 51 PID 1596 set thread context of 1504 1596 uroljornhr.exe 98 - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Ja8bxnt\uroljornhr.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Ja8bxnt\uroljornhr.exe raserver.exe File opened for modification C:\Program Files (x86)\Ja8bxnt Explorer.EXE File created C:\Program Files (x86)\Ja8bxnt\uroljornhr.exe Explorer.EXE -
description ioc Process Key created \Registry\User\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 raserver.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4516 PO0530322.exe 4516 PO0530322.exe 4852 PO0530322.exe 4852 PO0530322.exe 4852 PO0530322.exe 4852 PO0530322.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2776 Explorer.EXE - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 4852 PO0530322.exe 4852 PO0530322.exe 4852 PO0530322.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe 3516 raserver.exe - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 4516 PO0530322.exe Token: SeDebugPrivilege 4852 PO0530322.exe Token: SeShutdownPrivilege 2776 Explorer.EXE Token: SeCreatePagefilePrivilege 2776 Explorer.EXE Token: SeDebugPrivilege 3516 raserver.exe Token: SeShutdownPrivilege 2776 Explorer.EXE Token: SeCreatePagefilePrivilege 2776 Explorer.EXE Token: SeShutdownPrivilege 2776 Explorer.EXE Token: SeCreatePagefilePrivilege 2776 Explorer.EXE Token: SeShutdownPrivilege 2776 Explorer.EXE Token: SeCreatePagefilePrivilege 2776 Explorer.EXE Token: SeShutdownPrivilege 2776 Explorer.EXE Token: SeCreatePagefilePrivilege 2776 Explorer.EXE Token: SeDebugPrivilege 1504 uroljornhr.exe Token: SeShutdownPrivilege 2776 Explorer.EXE Token: SeCreatePagefilePrivilege 2776 Explorer.EXE Token: SeShutdownPrivilege 2776 Explorer.EXE Token: SeCreatePagefilePrivilege 2776 Explorer.EXE Token: SeShutdownPrivilege 2776 Explorer.EXE Token: SeCreatePagefilePrivilege 2776 Explorer.EXE Token: SeShutdownPrivilege 2776 Explorer.EXE Token: SeCreatePagefilePrivilege 2776 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2776 Explorer.EXE - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 4516 wrote to memory of 4784 4516 PO0530322.exe 89 PID 4516 wrote to memory of 4784 4516 PO0530322.exe 89 PID 4516 wrote to memory of 4784 4516 PO0530322.exe 89 PID 4516 wrote to memory of 4852 4516 PO0530322.exe 90 PID 4516 wrote to memory of 4852 4516 PO0530322.exe 90 PID 4516 wrote to memory of 4852 4516 PO0530322.exe 90 PID 4516 wrote to memory of 4852 4516 PO0530322.exe 90 PID 4516 wrote to memory of 4852 4516 PO0530322.exe 90 PID 4516 wrote to memory of 4852 4516 PO0530322.exe 90 PID 2776 wrote to memory of 3516 2776 Explorer.EXE 91 PID 2776 wrote to memory of 3516 2776 Explorer.EXE 91 PID 2776 wrote to memory of 3516 2776 Explorer.EXE 91 PID 3516 wrote to memory of 3656 3516 raserver.exe 92 PID 3516 wrote to memory of 3656 3516 raserver.exe 92 PID 3516 wrote to memory of 3656 3516 raserver.exe 92 PID 3516 wrote to memory of 1284 3516 raserver.exe 94 PID 3516 wrote to memory of 1284 3516 raserver.exe 94 PID 3516 wrote to memory of 1284 3516 raserver.exe 94 PID 3516 wrote to memory of 3952 3516 raserver.exe 96 PID 3516 wrote to memory of 3952 3516 raserver.exe 96 PID 2776 wrote to memory of 1596 2776 Explorer.EXE 97 PID 2776 wrote to memory of 1596 2776 Explorer.EXE 97 PID 2776 wrote to memory of 1596 2776 Explorer.EXE 97 PID 3516 wrote to memory of 3952 3516 raserver.exe 96 PID 1596 wrote to memory of 1504 1596 uroljornhr.exe 98 PID 1596 wrote to memory of 1504 1596 uroljornhr.exe 98 PID 1596 wrote to memory of 1504 1596 uroljornhr.exe 98 PID 1596 wrote to memory of 1504 1596 uroljornhr.exe 98 PID 1596 wrote to memory of 1504 1596 uroljornhr.exe 98 PID 1596 wrote to memory of 1504 1596 uroljornhr.exe 98
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"3⤵PID:4784
-
-
C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4852
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"3⤵PID:3656
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:1284
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3952
-
-
-
C:\Program Files (x86)\Ja8bxnt\uroljornhr.exe"C:\Program Files (x86)\Ja8bxnt\uroljornhr.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Program Files (x86)\Ja8bxnt\uroljornhr.exe"C:\Program Files (x86)\Ja8bxnt\uroljornhr.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1504
-
-