Analysis
-
max time kernel
600s -
max time network
601s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
22-03-2022 08:31
Static task
static1
Behavioral task
behavioral1
Sample
f5G3iGDs25iJjZE.exe
Resource
win7-20220310-en
General
-
Target
f5G3iGDs25iJjZE.exe
-
Size
1.1MB
-
MD5
33899614b3fe24bc02dfb4c1f84dabdc
-
SHA1
8dbc988c06f51cce14e4cc95717241fb1521fac6
-
SHA256
b36891ab4a7fa6be1680a65614dd5551a3fa8a89052c381a954601eedd82e62c
-
SHA512
30058e2e8d6da6b5e0db01cdab70cfb9af8bfb93aed69a009cdba0f1be4c9b805472a531a5abd4dc56f46349ff43a6ce797e98123898719a38e5329920aac5ad
Malware Config
Extracted
xloader
2.5
wdc8
mygotomaid.com
joyoushealthandwellnessspa.com
wefundprojects.com
magicbasketbourse.net
vitos3.xyz
oligopoly.city
beauty-bihada.asia
visitnewrichmond.com
crgeniusworld.biz
bantasis.com
transsexual.pro
casagraph.com
eastjamrecords.com
howtotrainyourmustache.com
heiappropriate.xyz
bataperu.com
ces341.com
prajahitha.com
manuelagattegger.com
wolfpackmotorcycletours.com
yulietrojas.com
dariven.com
dd13thsept.net
kalpeshvasoya.com
theavarosecollection.com
bloody-randoms.com
yngo-arca.com
dealsoffer.xyz
marellaweddingplanner.com
seowongoopain.com
omightygod.com
dqblog.net
thethreadedbrow.com
medflex.center
filpify.com
chaletxp.com
santanderburge.com
171341.com
shannongroves.com
sisoow.quest
harleybowd.com
cardioflextech.com
exspv.com
permianbasinautismacademy.info
gardenchipvip.com
onsitemarketingsolutions.com
cvwerg.com
theketocopywriter.com
telarte-ceramicas.com
j2ig529zbahs.biz
oxygenii.com
extralegally.info
hbdlaq.com
themountainkings.com
fibliz.com
skyrangersfoundation.com
forbabylon.net
weilaiyitj.com
supplementstoreryp.com
thehappyartnook.com
houzzcoin.com
heyitsnew.com
jonnystokes.com
venuesgrantprogram.com
hamiltonrealestate.online
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1592-137-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1940-144-0x0000000001070000-0x0000000001099000-memory.dmp xloader -
Executes dropped EXE 1 IoCs
Processes:
igfxvzf.exepid process 636 igfxvzf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msdt.exedescription ioc process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run msdt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\O43DUFWXF0 = "C:\\Program Files (x86)\\Ihv1pdx\\igfxvzf.exe" msdt.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
f5G3iGDs25iJjZE.exef5G3iGDs25iJjZE.exemsdt.exedescription pid process target process PID 3732 set thread context of 1592 3732 f5G3iGDs25iJjZE.exe f5G3iGDs25iJjZE.exe PID 1592 set thread context of 2060 1592 f5G3iGDs25iJjZE.exe Explorer.EXE PID 1940 set thread context of 2060 1940 msdt.exe Explorer.EXE -
Drops file in Program Files directory 4 IoCs
Processes:
Explorer.EXEmsdt.exedescription ioc process File created C:\Program Files (x86)\Ihv1pdx\igfxvzf.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Ihv1pdx\igfxvzf.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Ihv1pdx\igfxvzf.exe msdt.exe File opened for modification C:\Program Files (x86)\Ihv1pdx Explorer.EXE -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1536 636 WerFault.exe igfxvzf.exe -
Processes:
msdt.exedescription ioc process Key created \Registry\User\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msdt.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f5G3iGDs25iJjZE.exef5G3iGDs25iJjZE.exemsdt.exepid process 3732 f5G3iGDs25iJjZE.exe 3732 f5G3iGDs25iJjZE.exe 1592 f5G3iGDs25iJjZE.exe 1592 f5G3iGDs25iJjZE.exe 1592 f5G3iGDs25iJjZE.exe 1592 f5G3iGDs25iJjZE.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2060 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
f5G3iGDs25iJjZE.exemsdt.exepid process 1592 f5G3iGDs25iJjZE.exe 1592 f5G3iGDs25iJjZE.exe 1592 f5G3iGDs25iJjZE.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe 1940 msdt.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
f5G3iGDs25iJjZE.exef5G3iGDs25iJjZE.exemsdt.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3732 f5G3iGDs25iJjZE.exe Token: SeDebugPrivilege 1592 f5G3iGDs25iJjZE.exe Token: SeDebugPrivilege 1940 msdt.exe Token: SeShutdownPrivilege 2060 Explorer.EXE Token: SeCreatePagefilePrivilege 2060 Explorer.EXE Token: SeShutdownPrivilege 2060 Explorer.EXE Token: SeCreatePagefilePrivilege 2060 Explorer.EXE Token: SeShutdownPrivilege 2060 Explorer.EXE Token: SeCreatePagefilePrivilege 2060 Explorer.EXE Token: SeShutdownPrivilege 2060 Explorer.EXE Token: SeCreatePagefilePrivilege 2060 Explorer.EXE Token: SeShutdownPrivilege 2060 Explorer.EXE Token: SeCreatePagefilePrivilege 2060 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
f5G3iGDs25iJjZE.exeExplorer.EXEmsdt.exedescription pid process target process PID 3732 wrote to memory of 2376 3732 f5G3iGDs25iJjZE.exe f5G3iGDs25iJjZE.exe PID 3732 wrote to memory of 2376 3732 f5G3iGDs25iJjZE.exe f5G3iGDs25iJjZE.exe PID 3732 wrote to memory of 2376 3732 f5G3iGDs25iJjZE.exe f5G3iGDs25iJjZE.exe PID 3732 wrote to memory of 1592 3732 f5G3iGDs25iJjZE.exe f5G3iGDs25iJjZE.exe PID 3732 wrote to memory of 1592 3732 f5G3iGDs25iJjZE.exe f5G3iGDs25iJjZE.exe PID 3732 wrote to memory of 1592 3732 f5G3iGDs25iJjZE.exe f5G3iGDs25iJjZE.exe PID 3732 wrote to memory of 1592 3732 f5G3iGDs25iJjZE.exe f5G3iGDs25iJjZE.exe PID 3732 wrote to memory of 1592 3732 f5G3iGDs25iJjZE.exe f5G3iGDs25iJjZE.exe PID 3732 wrote to memory of 1592 3732 f5G3iGDs25iJjZE.exe f5G3iGDs25iJjZE.exe PID 2060 wrote to memory of 1940 2060 Explorer.EXE msdt.exe PID 2060 wrote to memory of 1940 2060 Explorer.EXE msdt.exe PID 2060 wrote to memory of 1940 2060 Explorer.EXE msdt.exe PID 1940 wrote to memory of 2988 1940 msdt.exe cmd.exe PID 1940 wrote to memory of 2988 1940 msdt.exe cmd.exe PID 1940 wrote to memory of 2988 1940 msdt.exe cmd.exe PID 1940 wrote to memory of 4648 1940 msdt.exe cmd.exe PID 1940 wrote to memory of 4648 1940 msdt.exe cmd.exe PID 1940 wrote to memory of 4648 1940 msdt.exe cmd.exe PID 1940 wrote to memory of 1152 1940 msdt.exe Firefox.exe PID 1940 wrote to memory of 1152 1940 msdt.exe Firefox.exe PID 2060 wrote to memory of 636 2060 Explorer.EXE igfxvzf.exe PID 2060 wrote to memory of 636 2060 Explorer.EXE igfxvzf.exe PID 2060 wrote to memory of 636 2060 Explorer.EXE igfxvzf.exe PID 1940 wrote to memory of 1152 1940 msdt.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f5G3iGDs25iJjZE.exe"C:\Users\Admin\AppData\Local\Temp\f5G3iGDs25iJjZE.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f5G3iGDs25iJjZE.exe"C:\Users\Admin\AppData\Local\Temp\f5G3iGDs25iJjZE.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\f5G3iGDs25iJjZE.exe"C:\Users\Admin\AppData\Local\Temp\f5G3iGDs25iJjZE.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\f5G3iGDs25iJjZE.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Ihv1pdx\igfxvzf.exe"C:\Program Files (x86)\Ihv1pdx\igfxvzf.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 11763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 636 -ip 6361⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Ihv1pdx\igfxvzf.exeMD5
0274a5571bbdc3173e0cd7358050f1a1
SHA1d75f9ae18bb0bc3870f49ee14fdf0c909fcc0ca4
SHA256781f165eb40ab8555b933b2487cf580ab627fdd00b766104ba5e53e69a9bdd5d
SHA512941516c63f6eb8dca9e679bedefe078884b39b12608cdfa33444b1943a0c8805276cfde287d39443b3fd65ef86de6bea712b703c9937e8a5123f471d511f36f2
-
C:\Program Files (x86)\Ihv1pdx\igfxvzf.exeMD5
0274a5571bbdc3173e0cd7358050f1a1
SHA1d75f9ae18bb0bc3870f49ee14fdf0c909fcc0ca4
SHA256781f165eb40ab8555b933b2487cf580ab627fdd00b766104ba5e53e69a9bdd5d
SHA512941516c63f6eb8dca9e679bedefe078884b39b12608cdfa33444b1943a0c8805276cfde287d39443b3fd65ef86de6bea712b703c9937e8a5123f471d511f36f2
-
C:\Users\Admin\AppData\Local\Temp\DB1MD5
b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
memory/636-153-0x00000000031F0000-0x0000000003282000-memory.dmpFilesize
584KB
-
memory/636-152-0x0000000072E70000-0x0000000073620000-memory.dmpFilesize
7.7MB
-
memory/636-151-0x0000000000D40000-0x0000000000E5C000-memory.dmpFilesize
1.1MB
-
memory/1592-141-0x0000000001200000-0x0000000001211000-memory.dmpFilesize
68KB
-
memory/1592-137-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1592-139-0x0000000001250000-0x000000000159A000-memory.dmpFilesize
3.3MB
-
memory/1592-140-0x000000000041D000-0x000000000041E000-memory.dmpFilesize
4KB
-
memory/1940-146-0x0000000003000000-0x0000000003090000-memory.dmpFilesize
576KB
-
memory/1940-144-0x0000000001070000-0x0000000001099000-memory.dmpFilesize
164KB
-
memory/1940-143-0x0000000000970000-0x00000000009C7000-memory.dmpFilesize
348KB
-
memory/1940-145-0x00000000031B0000-0x00000000034FA000-memory.dmpFilesize
3.3MB
-
memory/2060-142-0x0000000007E40000-0x0000000007F73000-memory.dmpFilesize
1.2MB
-
memory/2060-147-0x0000000007F80000-0x00000000080D9000-memory.dmpFilesize
1.3MB
-
memory/3732-130-0x0000000000630000-0x000000000074C000-memory.dmpFilesize
1.1MB
-
memory/3732-136-0x0000000008E40000-0x0000000008EDC000-memory.dmpFilesize
624KB
-
memory/3732-135-0x00000000051B0000-0x00000000051BA000-memory.dmpFilesize
40KB
-
memory/3732-134-0x0000000005060000-0x00000000050F2000-memory.dmpFilesize
584KB
-
memory/3732-133-0x0000000074E20000-0x00000000755D0000-memory.dmpFilesize
7.7MB
-
memory/3732-132-0x0000000005100000-0x0000000005192000-memory.dmpFilesize
584KB
-
memory/3732-131-0x00000000057B0000-0x0000000005D54000-memory.dmpFilesize
5.6MB