Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
08-08-2022 15:17
Static task
static1
Behavioral task
behavioral1
Sample
MIg6GXRiUigzu4y.exe
Resource
win7-20220715-en
General
-
Target
MIg6GXRiUigzu4y.exe
-
Size
839KB
-
MD5
3d9e5926621132ab400d7e48e75a305c
-
SHA1
76ff37c7cd8a6799209f07eb856a9fed573a47a1
-
SHA256
fd3393cafccfc4dd900d81a1314a7df6369114e72ba41c1bfa2fd6262c9f76db
-
SHA512
8a0ea160995aea373e23dc3e2d2840cbfc7826c50fd3d364f4f55506147496c74fce5c0305f62114663a0ac028a1c6998bbac5f1e2824e91ebe1d693403280c9
Malware Config
Extracted
xloader
2.8
nn40
LYAg0yANOGEAGeaFOrA/
MQWuERZplP+VZy/uszI=
CF0oDN0JimIaGy/uszI=
ltJnyC+ReohYaiTvj1qbEA==
B9OkgdctVKBAFjSUaw==
sbDVwSZVVqVB11/deow8GA==
v1gHDe0pzno=
i+/0n2vHUfGPR98k77tukZ90MQ==
SUtCnbS96Qm21g==
8X9qzyt1dpAo31jXrXfKb49fBPY=
5KlPxqHzSstuFjSUaw==
0r/Kesv/zuanroxvNQW0Gm8=
FFgS7kfPYAqpdhhgRgnBJHY=
LgusAHrkrIoWr0FWIe2o/04UXPw=
vBq9Gvxa9wbKbS/uszI=
Z+q6HAZNNeqwwQ==
wbS4fMb06SjU5Kbseow8GA==
1mZEuZvJ/m0L9bof56PkkZ90MQ==
JCJIM74lHk/o+tiFOrA/
d14FrM8rGEgIzVkT67+3XaEh
OtJqJTaZyD/bgy/uszI=
MMzqpo3pVjbaigine/p4W6dqZPJKkg==
LRS4MpnBeVxC/bqjf0kMBGop69QC
7FTxgWaTLAKbm3B0QgW0Gm8=
hjbYktAyum2JNK6N
WRtxyNlENeqwwQ==
MTOKH+0pzno=
8LkJ8EsWWHIK
zs758oMTaffAxI0bn2uqFw==
ariAXDqMsKpwF5U=
UEZOAmXFnpRh+rqD
T5e5xzlTNeqwwQ==
tp424+UDomI=
Y7VXD+I8CKVuDZQ=
zg6qeGbHO1F+FjSUaw==
JPypEB2CuDAz+bXSrjo=
8ah8cf5odcPNS+Sa
k+CGNhyOMKVuDZQ=
oVviitkD8B7ZmijeyIDFOI9nZPJKkg==
TtztqHfKKqQWuVRvT9fSSpJJmAFYLjw=
p6pvJHfZmJgx6XwYuL56b798MA==
WWmegczy4x2O+cIC27RtkZ90MQ==
/QrLiDyde3RJWRwRmWYo
PtShJAZG1WU6LP3osjo=
ZTrOf2PMho1kdm/JtSU=
A1ssC+pS8dvNS+Sa
K4g38tVda8DNS+Sa
Dz7fj13DnKh1iV8++X2H8Fbeq1jBGh4D
0AjPwNQtnWUEpDBAJbq9GG8p69QC
ALhKrIu7/5BTRf1OQAW0Gm8=
a5Zp3GrGWhzmrBYRmWYo
dwzcQzpnYYAi8G7eypfSS6d3oWmQnQ==
VR3AHfcDyG79m6bm0YnEOEBS/fQ=
pyZFKiWXNaVuDZQ=
dzf0zzBlYaqLFjSUaw==
D6TIj16hJ8JhJMom8rlxkZ90MQ==
8qkyvpp56Qm21g==
4qNmKHymVg3Bx4M=
MOiH6DRYhutyFjSUaw==
JqTDnm+zOQLV+83Ucm9GDw==
YQilIAQqUM5vFjSUaw==
84U/nbvTQwzcyQ==
mC34kB9LdeJuFjSUaw==
DKLKrbwuuWyJNK6N
thisismyhomevalue.com
Signatures
-
Xloader payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2336-188-0x000000000041F640-mapping.dmp xloader behavioral2/memory/2336-187-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral2/memory/2336-203-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral2/memory/4728-245-0x00000000007A0000-0x00000000007CC000-memory.dmp xloader behavioral2/memory/4728-248-0x00000000046F0000-0x000000000488F000-memory.dmp xloader -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MIg6GXRiUigzu4y.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Control Panel\International\Geo\Nation MIg6GXRiUigzu4y.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
MIg6GXRiUigzu4y.exeMIg6GXRiUigzu4y.execontrol.exedescription pid process target process PID 2668 set thread context of 2336 2668 MIg6GXRiUigzu4y.exe MIg6GXRiUigzu4y.exe PID 2336 set thread context of 3068 2336 MIg6GXRiUigzu4y.exe Explorer.EXE PID 4728 set thread context of 3068 4728 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
MIg6GXRiUigzu4y.execontrol.exepid process 2336 MIg6GXRiUigzu4y.exe 2336 MIg6GXRiUigzu4y.exe 2336 MIg6GXRiUigzu4y.exe 2336 MIg6GXRiUigzu4y.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe 4728 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3068 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
MIg6GXRiUigzu4y.execontrol.exepid process 2336 MIg6GXRiUigzu4y.exe 2336 MIg6GXRiUigzu4y.exe 2336 MIg6GXRiUigzu4y.exe 4728 control.exe 4728 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
MIg6GXRiUigzu4y.execontrol.exedescription pid process Token: SeDebugPrivilege 2336 MIg6GXRiUigzu4y.exe Token: SeDebugPrivilege 4728 control.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
MIg6GXRiUigzu4y.exeExplorer.EXEdescription pid process target process PID 2668 wrote to memory of 2336 2668 MIg6GXRiUigzu4y.exe MIg6GXRiUigzu4y.exe PID 2668 wrote to memory of 2336 2668 MIg6GXRiUigzu4y.exe MIg6GXRiUigzu4y.exe PID 2668 wrote to memory of 2336 2668 MIg6GXRiUigzu4y.exe MIg6GXRiUigzu4y.exe PID 2668 wrote to memory of 2336 2668 MIg6GXRiUigzu4y.exe MIg6GXRiUigzu4y.exe PID 2668 wrote to memory of 2336 2668 MIg6GXRiUigzu4y.exe MIg6GXRiUigzu4y.exe PID 2668 wrote to memory of 2336 2668 MIg6GXRiUigzu4y.exe MIg6GXRiUigzu4y.exe PID 3068 wrote to memory of 4728 3068 Explorer.EXE control.exe PID 3068 wrote to memory of 4728 3068 Explorer.EXE control.exe PID 3068 wrote to memory of 4728 3068 Explorer.EXE control.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MIg6GXRiUigzu4y.exe"C:\Users\Admin\AppData\Local\Temp\MIg6GXRiUigzu4y.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MIg6GXRiUigzu4y.exe"C:\Users\Admin\AppData\Local\Temp\MIg6GXRiUigzu4y.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2336-188-0x000000000041F640-mapping.dmp
-
memory/2336-187-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2336-189-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2336-190-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2336-191-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2336-207-0x00000000012D0000-0x000000000146E000-memory.dmpFilesize
1.6MB
-
memory/2336-205-0x0000000001470000-0x0000000001790000-memory.dmpFilesize
3.1MB
-
memory/2336-203-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2668-154-0x0000000005500000-0x00000000059FE000-memory.dmpFilesize
5.0MB
-
memory/2668-184-0x0000000008AD0000-0x0000000008B6C000-memory.dmpFilesize
624KB
-
memory/2668-122-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-123-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-124-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-125-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-126-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-127-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-128-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-129-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-130-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-158-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-132-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-133-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-134-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-135-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-136-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-137-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-138-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-139-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-140-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-141-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-142-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-143-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-144-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-145-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-146-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-147-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-148-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-149-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-150-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-151-0x00000000006F0000-0x00000000007C8000-memory.dmpFilesize
864KB
-
memory/2668-152-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-160-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-120-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-155-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-156-0x0000000005000000-0x0000000005092000-memory.dmpFilesize
584KB
-
memory/2668-157-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-131-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-121-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-153-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-161-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-162-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-163-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-164-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-165-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-166-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-167-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-168-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-169-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-170-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-171-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-172-0x0000000005160000-0x000000000516A000-memory.dmpFilesize
40KB
-
memory/2668-173-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-174-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-175-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-176-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-177-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-178-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-179-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-180-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-181-0x0000000007430000-0x0000000007450000-memory.dmpFilesize
128KB
-
memory/2668-119-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-118-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-117-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-182-0x0000000008910000-0x000000000891C000-memory.dmpFilesize
48KB
-
memory/2668-183-0x00000000089B0000-0x0000000008A22000-memory.dmpFilesize
456KB
-
memory/2668-159-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/2668-185-0x0000000008BE0000-0x0000000008C46000-memory.dmpFilesize
408KB
-
memory/2668-186-0x0000000008A80000-0x0000000008AB2000-memory.dmpFilesize
200KB
-
memory/3068-214-0x0000000002C20000-0x0000000002D35000-memory.dmpFilesize
1.1MB
-
memory/3068-249-0x00000000053C0000-0x00000000054DB000-memory.dmpFilesize
1.1MB
-
memory/3068-251-0x00000000053C0000-0x00000000054DB000-memory.dmpFilesize
1.1MB
-
memory/4728-215-0x0000000000000000-mapping.dmp
-
memory/4728-244-0x0000000000A10000-0x0000000000A30000-memory.dmpFilesize
128KB
-
memory/4728-245-0x00000000007A0000-0x00000000007CC000-memory.dmpFilesize
176KB
-
memory/4728-246-0x0000000004890000-0x0000000004BB0000-memory.dmpFilesize
3.1MB
-
memory/4728-248-0x00000000046F0000-0x000000000488F000-memory.dmpFilesize
1.6MB
-
memory/4728-250-0x00000000046F0000-0x000000000488F000-memory.dmpFilesize
1.6MB