Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-10-2022 14:12
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220812-en
General
-
Target
tmp.exe
-
Size
293KB
-
MD5
960b0f8219762d17f6f47ee76275c7c1
-
SHA1
ed0eaa1b2d7636d74713c86548842cdb72b8c8cd
-
SHA256
b47cf0eaed7e3798e77eaf01aac5783f2c03f7db7802a5215523d4ccdc631bc5
-
SHA512
06d9751f85266c92e666400dc911271e3354ca550a12a6e45386f46f23c56e02986d8a763f394ecbe470952379a752cb0ab26dee5dcc8d4cab84d28e34104ccc
-
SSDEEP
6144:eqJT5/+TVlkf7jWDUaLOjYmCVdKrLVi2D9y4CUFHHv:e61+BIjbaafCi/Vi2D9yJU1
Malware Config
Extracted
Family |
xloader |
Version |
2.6 |
Campaign |
zgtb |
Decoy |
gabriellep.com honghe4.xyz anisaofrendas.com happy-tile.com thesulkies.com international-ipo.com tazeco.info hhhzzz.xyz vrmonster.xyz theearthresidencia.com sportape.xyz elshadaibaterias.com koredeiihibi.com taxtaa.com globalcityb.com fxivcama.com dagsmith.com elmar-bhp.com peakice.net jhcdjewelry.com moradagroup.tech luminantentertainment.com originalfatfrog.com istanbulbahis239.com digismart.cloud egclass.com video-raamsdonk.online enjoyhavoc.online elegantmuka.com crememeup.store gasgangllc.com worldmarketking.com johnywan.icu ctxd089.com vipbuy-my.com cboelua.com sitesv.com 7788tiepin.com unionfound.com freecrdditreport.com symmetrya.online thinoe.com line-view.com immobilien-mj.com alignedmagic.com mecontaisso.com plumberbalanced.com zhouwuxiawu.com obokbusinessbootcamp.com chance-lo.com jujuskiny.com kkrcrzyz.xyz daquan168.com groupeinvictuscorporation.com leadswebhosting.com payphelpcenter950851354.info subvip60.site ink-desk.com luminaurascent.com jivraj9india.com topproroofer.com nxteam.net can-amexico.com premhub.club zs-yaoshi.com |
Signatures
-
Xloader payload ⋅ 5 IoCs
Processes:
resource yara_rule behavioral1/memory/736-63-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/736-64-0x000000000041F1F0-mapping.dmp xloader behavioral1/memory/736-66-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/972-76-0x0000000000080000-0x00000000000AB000-memory.dmp xloader behavioral1/memory/972-80-0x0000000000080000-0x00000000000AB000-memory.dmp xloader -
Adds policy Run key to start application ⋅ 2 TTPs 2 IoCs
Processes:
mstsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run mstsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\J0HDI47HUBA = "C:\\Program Files (x86)\\Mrdfd0t\\mfcmrhl7bm.exe" mstsc.exe -
Drops startup file ⋅ 2 IoCs
Processes:
Powershell.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%Namee% Powershell.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%Namee% Powershell.exe -
Suspicious use of SetThreadContext ⋅ 3 IoCs
Processes:
tmp.exeaspnet_compiler.exemstsc.exedescription pid process target process PID 1300 set thread context of 736 1300 tmp.exe aspnet_compiler.exe PID 736 set thread context of 1188 736 aspnet_compiler.exe Explorer.EXE PID 972 set thread context of 1188 972 mstsc.exe Explorer.EXE -
Drops file in Program Files directory ⋅ 1 IoCs
Processes:
mstsc.exedescription ioc process File opened for modification C:\Program Files (x86)\Mrdfd0t\mfcmrhl7bm.exe mstsc.exe -
TTPs:
Processes:
mstsc.exedescription ioc process Key created \Registry\User\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 mstsc.exe -
Suspicious behavior: EnumeratesProcesses ⋅ 21 IoCs
Processes:
aspnet_compiler.exePowershell.exemstsc.exepid process 736 aspnet_compiler.exe 736 aspnet_compiler.exe 1312 Powershell.exe 972 mstsc.exe 972 mstsc.exe 972 mstsc.exe 972 mstsc.exe 972 mstsc.exe 972 mstsc.exe 972 mstsc.exe 972 mstsc.exe 972 mstsc.exe 972 mstsc.exe 972 mstsc.exe 972 mstsc.exe 972 mstsc.exe 972 mstsc.exe 972 mstsc.exe 972 mstsc.exe 972 mstsc.exe 972 mstsc.exe -
Suspicious behavior: MapViewOfSection ⋅ 7 IoCs
Processes:
aspnet_compiler.exemstsc.exepid process 736 aspnet_compiler.exe 736 aspnet_compiler.exe 736 aspnet_compiler.exe 972 mstsc.exe 972 mstsc.exe 972 mstsc.exe 972 mstsc.exe -
Suspicious use of AdjustPrivilegeToken ⋅ 4 IoCs
Processes:
tmp.exeaspnet_compiler.exePowershell.exemstsc.exedescription pid process Token: SeDebugPrivilege 1300 tmp.exe Token: SeDebugPrivilege 736 aspnet_compiler.exe Token: SeDebugPrivilege 1312 Powershell.exe Token: SeDebugPrivilege 972 mstsc.exe -
Suspicious use of FindShellTrayWindow ⋅ 2 IoCs
Processes:
Explorer.EXEpid process 1188 Explorer.EXE 1188 Explorer.EXE -
Suspicious use of SendNotifyMessage ⋅ 2 IoCs
Processes:
Explorer.EXEpid process 1188 Explorer.EXE 1188 Explorer.EXE -
Suspicious use of WriteProcessMemory ⋅ 24 IoCs
Processes:
tmp.exeExplorer.EXEmstsc.exedescription pid process target process PID 1300 wrote to memory of 1312 1300 tmp.exe Powershell.exe PID 1300 wrote to memory of 1312 1300 tmp.exe Powershell.exe PID 1300 wrote to memory of 1312 1300 tmp.exe Powershell.exe PID 1300 wrote to memory of 1312 1300 tmp.exe Powershell.exe PID 1300 wrote to memory of 736 1300 tmp.exe aspnet_compiler.exe PID 1300 wrote to memory of 736 1300 tmp.exe aspnet_compiler.exe PID 1300 wrote to memory of 736 1300 tmp.exe aspnet_compiler.exe PID 1300 wrote to memory of 736 1300 tmp.exe aspnet_compiler.exe PID 1300 wrote to memory of 736 1300 tmp.exe aspnet_compiler.exe PID 1300 wrote to memory of 736 1300 tmp.exe aspnet_compiler.exe PID 1300 wrote to memory of 736 1300 tmp.exe aspnet_compiler.exe PID 1188 wrote to memory of 972 1188 Explorer.EXE mstsc.exe PID 1188 wrote to memory of 972 1188 Explorer.EXE mstsc.exe PID 1188 wrote to memory of 972 1188 Explorer.EXE mstsc.exe PID 1188 wrote to memory of 972 1188 Explorer.EXE mstsc.exe PID 972 wrote to memory of 1800 972 mstsc.exe cmd.exe PID 972 wrote to memory of 1800 972 mstsc.exe cmd.exe PID 972 wrote to memory of 1800 972 mstsc.exe cmd.exe PID 972 wrote to memory of 1800 972 mstsc.exe cmd.exe PID 972 wrote to memory of 1760 972 mstsc.exe Firefox.exe PID 972 wrote to memory of 1760 972 mstsc.exe Firefox.exe PID 972 wrote to memory of 1760 972 mstsc.exe Firefox.exe PID 972 wrote to memory of 1760 972 mstsc.exe Firefox.exe PID 972 wrote to memory of 1760 972 mstsc.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXESuspicious use of FindShellTrayWindowSuspicious use of SendNotifyMessageSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"Suspicious use of SetThreadContextSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\tmp.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%Namee%'Drops startup fileSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"Suspicious use of SetThreadContextSuspicious behavior: EnumeratesProcessesSuspicious behavior: MapViewOfSectionSuspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"Adds policy Run key to start applicationSuspicious use of SetThreadContextDrops file in Program Files directoryModifies Internet Explorer settingsSuspicious behavior: EnumeratesProcessesSuspicious behavior: MapViewOfSectionSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
Downloads
-
memory/736-63-0x0000000000400000-0x000000000042B000-memory.dmp
-
memory/736-68-0x0000000000450000-0x0000000000461000-memory.dmp
-
memory/736-67-0x0000000000700000-0x0000000000A03000-memory.dmp
-
memory/736-66-0x0000000000400000-0x000000000042B000-memory.dmp
-
memory/736-64-0x000000000041F1F0-mapping.dmp
-
memory/736-60-0x0000000000400000-0x000000000042B000-memory.dmp
-
memory/736-61-0x0000000000400000-0x000000000042B000-memory.dmp
-
memory/972-76-0x0000000000080000-0x00000000000AB000-memory.dmp
-
memory/972-71-0x0000000000000000-mapping.dmp
-
memory/972-80-0x0000000000080000-0x00000000000AB000-memory.dmp
-
memory/972-78-0x0000000000970000-0x0000000000A00000-memory.dmp
-
memory/972-77-0x0000000002120000-0x0000000002423000-memory.dmp
-
memory/972-75-0x0000000000A80000-0x0000000000B84000-memory.dmp
-
memory/1188-79-0x00000000042A0000-0x000000000433B000-memory.dmp
-
memory/1188-69-0x0000000004010000-0x00000000040C8000-memory.dmp
-
memory/1188-81-0x00000000042A0000-0x000000000433B000-memory.dmp
-
memory/1300-54-0x0000000000850000-0x00000000008A0000-memory.dmp
-
memory/1300-55-0x0000000000320000-0x0000000000366000-memory.dmp
-
memory/1300-56-0x0000000074F41000-0x0000000074F43000-memory.dmp
-
memory/1300-58-0x00000000004E0000-0x00000000004FC000-memory.dmp
-
memory/1312-70-0x00000000744F0000-0x0000000074A9B000-memory.dmp
-
memory/1312-73-0x00000000744F0000-0x0000000074A9B000-memory.dmp
-
memory/1312-57-0x0000000000000000-mapping.dmp
-
memory/1800-74-0x0000000000000000-mapping.dmp