Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2022 13:39
Static task
static1
Behavioral task
behavioral1
Sample
819d2fdff92e281140049b008d9e368f.exe
Resource
win7-20220715-en
General
-
Target
819d2fdff92e281140049b008d9e368f.exe
-
Size
889KB
-
MD5
819d2fdff92e281140049b008d9e368f
-
SHA1
2ee177f5965d7275e9dd04bb888a7c5578b19e07
-
SHA256
d44bc10f5bd18cc0467b5c3198014ff93c133b12b503b860c8d7eeba0ca60329
-
SHA512
be2255c7c1eabf628cfd96281cdbc12b8379be5d94e0080dbd4f8bc86efe02ee252137d68499f5d55b3e20d5eb89e593443a1315ad122b20238d67348e62e90a
Malware Config
Extracted
xloader
2.6
pdrq
welchsunstar.com
mppservicesllc.com
wiresofteflon.com
brabov.xyz
compnonoch.site
yourbuilderworks.com
iamsamirahman.com
eriqoes.com
eastudio.design
skyearth-est.com
teethfitness.com
razaancreates.com
shfbfs.com
joyfulbrokekids.com
kjbolden.com
howirep.com
deedeesmainecoons.website
e-powair.com
aheatea.com
shalfey0009.xyz
designcolor.style
netflixpaymentpending.ca
bothoitrang3.site
motondiarts.com
staynmocean.com
miamivideoshows.com
berendsit.com
yndzjs.com
yiwenhome.xyz
royaldeals.net
clearvison-ts.com
peluqueriasusanagalan.com
thelittlewellnessstudio.com
gurulotaska.com
smgsj.com
followpanelbd.com
prinirwedding.com
3559.fyi
amcvips.com
bigroof.top
chipbio-zt.com
candelasluxuryretreat.com
jboycephotography.com
affiliateindex.xyz
grannysseasonings.com
lcl-inc-test.com
beadallcreations.jewelry
yzzhome.top
tobe-science.com
cincinnaticustomrenovation.com
survaicommercial.xyz
businessdirectorymania.com
phqworld.com
miamigocars.com
labfour.systems
gregoryzeitler.com
dj-mary.com
one1-day.com
vegfiber.com
sfbayraw.net
xn--bndarsloto-s4a.com
felipesb.com
108580.com
1swj06mjrowgi.xyz
koalaglen.com
Signatures
-
Xloader payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1044-143-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral2/memory/1044-147-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral2/memory/1624-161-0x0000000000760000-0x000000000078B000-memory.dmp xloader behavioral2/memory/1624-167-0x0000000000760000-0x000000000078B000-memory.dmp xloader -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
819d2fdff92e281140049b008d9e368f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation 819d2fdff92e281140049b008d9e368f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
raserver.exedescription ioc process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run raserver.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GDTPBHE8UP = "C:\\Program Files (x86)\\Qx2kdeflh\\rbxhp_pch.exe" raserver.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
819d2fdff92e281140049b008d9e368f.exeRegSvcs.exeraserver.exedescription pid process target process PID 3460 set thread context of 1044 3460 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 1044 set thread context of 2196 1044 RegSvcs.exe Explorer.EXE PID 1624 set thread context of 2196 1624 raserver.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
raserver.exedescription ioc process File opened for modification C:\Program Files (x86)\Qx2kdeflh\rbxhp_pch.exe raserver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
raserver.exedescription ioc process Key created \Registry\User\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 raserver.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
819d2fdff92e281140049b008d9e368f.exepowershell.exeRegSvcs.exeraserver.exepid process 3460 819d2fdff92e281140049b008d9e368f.exe 3460 819d2fdff92e281140049b008d9e368f.exe 3460 819d2fdff92e281140049b008d9e368f.exe 3460 819d2fdff92e281140049b008d9e368f.exe 5096 powershell.exe 1044 RegSvcs.exe 1044 RegSvcs.exe 1044 RegSvcs.exe 1044 RegSvcs.exe 5096 powershell.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2196 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
RegSvcs.exeraserver.exepid process 1044 RegSvcs.exe 1044 RegSvcs.exe 1044 RegSvcs.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe 1624 raserver.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
819d2fdff92e281140049b008d9e368f.exepowershell.exeRegSvcs.exeraserver.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3460 819d2fdff92e281140049b008d9e368f.exe Token: SeDebugPrivilege 5096 powershell.exe Token: SeDebugPrivilege 1044 RegSvcs.exe Token: SeDebugPrivilege 1624 raserver.exe Token: SeShutdownPrivilege 2196 Explorer.EXE Token: SeCreatePagefilePrivilege 2196 Explorer.EXE -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
819d2fdff92e281140049b008d9e368f.exeExplorer.EXEraserver.exedescription pid process target process PID 3460 wrote to memory of 5096 3460 819d2fdff92e281140049b008d9e368f.exe powershell.exe PID 3460 wrote to memory of 5096 3460 819d2fdff92e281140049b008d9e368f.exe powershell.exe PID 3460 wrote to memory of 5096 3460 819d2fdff92e281140049b008d9e368f.exe powershell.exe PID 3460 wrote to memory of 1340 3460 819d2fdff92e281140049b008d9e368f.exe schtasks.exe PID 3460 wrote to memory of 1340 3460 819d2fdff92e281140049b008d9e368f.exe schtasks.exe PID 3460 wrote to memory of 1340 3460 819d2fdff92e281140049b008d9e368f.exe schtasks.exe PID 3460 wrote to memory of 1148 3460 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 3460 wrote to memory of 1148 3460 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 3460 wrote to memory of 1148 3460 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 3460 wrote to memory of 1044 3460 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 3460 wrote to memory of 1044 3460 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 3460 wrote to memory of 1044 3460 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 3460 wrote to memory of 1044 3460 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 3460 wrote to memory of 1044 3460 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 3460 wrote to memory of 1044 3460 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 2196 wrote to memory of 1624 2196 Explorer.EXE raserver.exe PID 2196 wrote to memory of 1624 2196 Explorer.EXE raserver.exe PID 2196 wrote to memory of 1624 2196 Explorer.EXE raserver.exe PID 1624 wrote to memory of 4912 1624 raserver.exe cmd.exe PID 1624 wrote to memory of 4912 1624 raserver.exe cmd.exe PID 1624 wrote to memory of 4912 1624 raserver.exe cmd.exe PID 1624 wrote to memory of 3704 1624 raserver.exe cmd.exe PID 1624 wrote to memory of 3704 1624 raserver.exe cmd.exe PID 1624 wrote to memory of 3704 1624 raserver.exe cmd.exe PID 1624 wrote to memory of 4976 1624 raserver.exe cmd.exe PID 1624 wrote to memory of 4976 1624 raserver.exe cmd.exe PID 1624 wrote to memory of 4976 1624 raserver.exe cmd.exe PID 1624 wrote to memory of 2384 1624 raserver.exe Firefox.exe PID 1624 wrote to memory of 2384 1624 raserver.exe Firefox.exe PID 1624 wrote to memory of 2384 1624 raserver.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\819d2fdff92e281140049b008d9e368f.exe"C:\Users\Admin\AppData\Local\Temp\819d2fdff92e281140049b008d9e368f.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IlJWnRO.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IlJWnRO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp44E8.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
40KB
MD5b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
C:\Users\Admin\AppData\Local\Temp\tmp44E8.tmpFilesize
1KB
MD5959dc3743594bf67b4b9e2208e7a451d
SHA1024168d5e87c24d3fbd0cc29c75e10683cef1c71
SHA2565548957edf2a9f3a277cfd4a525d860faf50b459f3537cb5b43d8fe05bd7f1ee
SHA5121adbea7341be31057d9c2410728124b8bd8baaaa9ef06908f1ba2c4830a50a2b9ea21c7cc2d4119ac4fd832ae62d56633ca68ba31a1eae3b3dca47812aa4c7f5
-
memory/1044-149-0x0000000001520000-0x0000000001531000-memory.dmpFilesize
68KB
-
memory/1044-148-0x00000000019C0000-0x0000000001D0A000-memory.dmpFilesize
3.3MB
-
memory/1044-147-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1044-143-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1044-142-0x0000000000000000-mapping.dmp
-
memory/1148-140-0x0000000000000000-mapping.dmp
-
memory/1340-137-0x0000000000000000-mapping.dmp
-
memory/1624-168-0x0000000002680000-0x0000000002710000-memory.dmpFilesize
576KB
-
memory/1624-160-0x00000000005F0000-0x000000000060F000-memory.dmpFilesize
124KB
-
memory/1624-158-0x0000000000000000-mapping.dmp
-
memory/1624-161-0x0000000000760000-0x000000000078B000-memory.dmpFilesize
172KB
-
memory/1624-165-0x00000000027F0000-0x0000000002B3A000-memory.dmpFilesize
3.3MB
-
memory/1624-167-0x0000000000760000-0x000000000078B000-memory.dmpFilesize
172KB
-
memory/2196-170-0x0000000007A40000-0x0000000007B47000-memory.dmpFilesize
1.0MB
-
memory/2196-169-0x0000000007A40000-0x0000000007B47000-memory.dmpFilesize
1.0MB
-
memory/2196-150-0x00000000024F0000-0x00000000025B3000-memory.dmpFilesize
780KB
-
memory/3460-132-0x0000000004D10000-0x0000000004DA2000-memory.dmpFilesize
584KB
-
memory/3460-131-0x0000000005390000-0x0000000005934000-memory.dmpFilesize
5.6MB
-
memory/3460-133-0x0000000004E10000-0x0000000004E1A000-memory.dmpFilesize
40KB
-
memory/3460-130-0x00000000003C0000-0x00000000004A4000-memory.dmpFilesize
912KB
-
memory/3460-134-0x00000000086B0000-0x000000000874C000-memory.dmpFilesize
624KB
-
memory/3460-135-0x000000000B240000-0x000000000B2A6000-memory.dmpFilesize
408KB
-
memory/3704-171-0x0000000000000000-mapping.dmp
-
memory/4912-162-0x0000000000000000-mapping.dmp
-
memory/4976-173-0x0000000000000000-mapping.dmp
-
memory/5096-153-0x0000000071120000-0x000000007116C000-memory.dmpFilesize
304KB
-
memory/5096-159-0x0000000007DA0000-0x0000000007E36000-memory.dmpFilesize
600KB
-
memory/5096-157-0x0000000007B90000-0x0000000007B9A000-memory.dmpFilesize
40KB
-
memory/5096-156-0x0000000007B20000-0x0000000007B3A000-memory.dmpFilesize
104KB
-
memory/5096-163-0x0000000007D50000-0x0000000007D5E000-memory.dmpFilesize
56KB
-
memory/5096-164-0x0000000007E60000-0x0000000007E7A000-memory.dmpFilesize
104KB
-
memory/5096-155-0x0000000008170000-0x00000000087EA000-memory.dmpFilesize
6.5MB
-
memory/5096-166-0x0000000007E40000-0x0000000007E48000-memory.dmpFilesize
32KB
-
memory/5096-154-0x0000000006DC0000-0x0000000006DDE000-memory.dmpFilesize
120KB
-
memory/5096-152-0x0000000006DE0000-0x0000000006E12000-memory.dmpFilesize
200KB
-
memory/5096-151-0x0000000006820000-0x000000000683E000-memory.dmpFilesize
120KB
-
memory/5096-145-0x00000000058E0000-0x0000000005946000-memory.dmpFilesize
408KB
-
memory/5096-144-0x0000000005840000-0x0000000005862000-memory.dmpFilesize
136KB
-
memory/5096-141-0x0000000005BA0000-0x00000000061C8000-memory.dmpFilesize
6.2MB
-
memory/5096-138-0x0000000002F10000-0x0000000002F46000-memory.dmpFilesize
216KB
-
memory/5096-136-0x0000000000000000-mapping.dmp