Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
08-08-2022 06:33
Behavioral task
behavioral1
Sample
0x000400000001abf7-133.exe
Resource
win7-20220715-en
General
-
Target
0x000400000001abf7-133.exe
-
Size
163KB
-
MD5
3f30211b37614224df9a078c65d4f6a0
-
SHA1
c8fd1bb4535f92df26a3550b7751076269270387
-
SHA256
a7059eb53ea10d1bb978e42d833069c10e6f472704c699228cfb84f94464a507
-
SHA512
24c6e7fb437d95ab074c30412cf7f99d00d61872721ad53c98843a3176172892e3278cc708717f5a601939f54a8dd6fd3c9aa6832fdac6f4633b1076e8b85939
Malware Config
Extracted
xloader
2.5
s0iw
ortopediamodelo.com
orimshirts.store
universecatholicweekly.info
yvettechan.com
sersaudavelsempre.online
face-booking.net
europeanretailgroup.com
umofan.com
roemahbajumuslim.online
joyrosecuisine.net
3dmaker.house
megdb.xyz
stereoshopie.info
gv5rm.com
tdc-trust.com
mcglobal.club
choral.works
onlineconsultantgroup.com
friscopaintandbody.com
midwestii.com
weespiel.com
babyshell.be
gwynora.com
talkthered.com
f-punk.com
frankmatlock.com
clique-solicite.net
clientloyaltysystem.com
worldbyduco.com
kampfsport-erfurt.com
adndpanel.xyz
rocknfamily.net
ambr-creative.com
wwwks8829.com
thuexegiarehcmgoviet.com
brentmurrell.art
wolf-yachts.com
tenpobiz.com
binnamall.com
crestamarti.quest
terry-hitchcock.com
ocreverseteam.com
taxwarehouse2.xyz
megawholesalesystem.com
epstein-advisory.com
enewlaunches.com
iphone13.community
pianostands.com
newspaper.clinic
alamdave.com
costalitaestepona2d.com
arbacan.com
horikoshi-online-tutoring.net
missingthered.com
ecmcenterprises.com
giaohangtietkiemhcm.com
universidademackenzie.com
kveupcsmimli.mobi
ibellex.com
ikigaiofficial.store
jerseyboysnorfolk.com
xiamensaikang.com
lmnsky.com
bra866.com
kyiejenner.com
Signatures
-
Xloader payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3480-137-0x0000000001310000-0x0000000001339000-memory.dmp xloader behavioral2/memory/3480-141-0x0000000001310000-0x0000000001339000-memory.dmp xloader -
Suspicious use of SetThreadContext 2 IoCs
Processes:
0x000400000001abf7-133.execscript.exedescription pid process target process PID 4976 set thread context of 3068 4976 0x000400000001abf7-133.exe Explorer.EXE PID 3480 set thread context of 3068 3480 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
0x000400000001abf7-133.execscript.exepid process 4976 0x000400000001abf7-133.exe 4976 0x000400000001abf7-133.exe 4976 0x000400000001abf7-133.exe 4976 0x000400000001abf7-133.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe 3480 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3068 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
0x000400000001abf7-133.execscript.exepid process 4976 0x000400000001abf7-133.exe 4976 0x000400000001abf7-133.exe 4976 0x000400000001abf7-133.exe 3480 cscript.exe 3480 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0x000400000001abf7-133.execscript.exedescription pid process Token: SeDebugPrivilege 4976 0x000400000001abf7-133.exe Token: SeDebugPrivilege 3480 cscript.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Explorer.EXEcscript.exedescription pid process target process PID 3068 wrote to memory of 3480 3068 Explorer.EXE cscript.exe PID 3068 wrote to memory of 3480 3068 Explorer.EXE cscript.exe PID 3068 wrote to memory of 3480 3068 Explorer.EXE cscript.exe PID 3480 wrote to memory of 4156 3480 cscript.exe cmd.exe PID 3480 wrote to memory of 4156 3480 cscript.exe cmd.exe PID 3480 wrote to memory of 4156 3480 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0x000400000001abf7-133.exe"C:\Users\Admin\AppData\Local\Temp\0x000400000001abf7-133.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\0x000400000001abf7-133.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3068-134-0x0000000008150000-0x00000000082D0000-memory.dmpFilesize
1.5MB
-
memory/3068-142-0x00000000082D0000-0x000000000843A000-memory.dmpFilesize
1.4MB
-
memory/3068-143-0x00000000082D0000-0x000000000843A000-memory.dmpFilesize
1.4MB
-
memory/3480-135-0x0000000000000000-mapping.dmp
-
memory/3480-136-0x0000000000C90000-0x0000000000CB7000-memory.dmpFilesize
156KB
-
memory/3480-137-0x0000000001310000-0x0000000001339000-memory.dmpFilesize
164KB
-
memory/3480-138-0x0000000003430000-0x000000000377A000-memory.dmpFilesize
3.3MB
-
memory/3480-140-0x0000000003260000-0x00000000032F0000-memory.dmpFilesize
576KB
-
memory/3480-141-0x0000000001310000-0x0000000001339000-memory.dmpFilesize
164KB
-
memory/4156-139-0x0000000000000000-mapping.dmp
-
memory/4976-132-0x0000000001440000-0x000000000178A000-memory.dmpFilesize
3.3MB
-
memory/4976-133-0x0000000000F80000-0x0000000000F91000-memory.dmpFilesize
68KB