Analysis
-
max time kernel
147s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 21:31
Static task
static1
Behavioral task
behavioral1
Sample
e3cafecde4e7f884fb0a05a85dd018458e8751e0ab131217eafb8bba38750e44.exe
Resource
win7-20221111-en
General
-
Target
e3cafecde4e7f884fb0a05a85dd018458e8751e0ab131217eafb8bba38750e44.exe
-
Size
237KB
-
MD5
82c86dbc4be9873c9d7f773c371d5a3c
-
SHA1
d051bd168855c25999de5d13688bfd62bcf58098
-
SHA256
e3cafecde4e7f884fb0a05a85dd018458e8751e0ab131217eafb8bba38750e44
-
SHA512
3dc86335e60719f19b5ee0ee57caa48e2ead7e26a06667f0292ae73a53e46d7fdec222636b7a2370f292fd00e2e9e9a04d0518ce8d7b0153e45ab43ba3bd1332
-
SSDEEP
6144:AsJeHC202Fx/8DbGbppIQawYy+NvpkwBYDktba181t:HeHX0YabCppZ73+NKwBQktba181t
Malware Config
Extracted
xloader
2.3
m3de
ad-unity.com
republicans2032.com
blackculturewriters.com
wallnewphoto.com
etripideas.com
solarphlare.com
consultoranexo.com
hayasalon.com
pillowcasefactory.club
service-manbzcsexer.com
medicinerx.today
oliviarescigno.com
tomcruise.club
tetsim.com
atonalai.net
malcomsons.com
straitskids.com
luca-cci.com
pero.financial
wowbdshop.com
williammassimi.com
856379738.xyz
freshsifish.com
instinctbands.com
immignet.com
contex3.info
rawvegangoods.com
sn1008.com
lyo.xyz
hopefulsoil.com
igxwdxggfg8d2.net
gp240.com
martymohr.com
divineseo.com
nelvine.com
cryptotshirtshop.com
linglingproperty.com
tvdeu.com
massiv.agency
helforddepositaryservices.com
moneys365.online
stagepins.com
techinspect.online
playrajshreelucky.com
wingmonsters.com
cleveland.sucks
karmikclothing.com
tuandphillip.com
gywj2020.com
lapicy.com
schwarzwald-erleben.net
citestaccnt1597754245.com
perfectretreatswa.com
canadianmusicindustrycd.com
muhunt.net
arcax.info
avpwine.com
blazingsandals.com
rcdfashion.info
darling-date.com
nashrahsecretz.com
houstongundealer.com
parislovearts.com
bagibaso.com
sunsfactory.net
Signatures
-
Xloader payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1264-55-0x00000000005C0000-0x00000000005FC000-memory.dmp xloader behavioral1/memory/1264-56-0x0000000000620000-0x0000000000648000-memory.dmp xloader behavioral1/memory/996-63-0x000000000041CFD0-mapping.dmp xloader behavioral1/memory/996-65-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1396-72-0x0000000000080000-0x00000000000A8000-memory.dmp xloader behavioral1/memory/1396-76-0x0000000000080000-0x00000000000A8000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
e3cafecde4e7f884fb0a05a85dd018458e8751e0ab131217eafb8bba38750e44.exesvchost.exeNAPSTAT.EXEdescription pid process target process PID 1264 set thread context of 996 1264 e3cafecde4e7f884fb0a05a85dd018458e8751e0ab131217eafb8bba38750e44.exe svchost.exe PID 996 set thread context of 1188 996 svchost.exe Explorer.EXE PID 1396 set thread context of 1188 1396 NAPSTAT.EXE Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
svchost.exeNAPSTAT.EXEpid process 996 svchost.exe 996 svchost.exe 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1188 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
svchost.exeNAPSTAT.EXEpid process 996 svchost.exe 996 svchost.exe 996 svchost.exe 1396 NAPSTAT.EXE 1396 NAPSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.exeNAPSTAT.EXEdescription pid process Token: SeDebugPrivilege 996 svchost.exe Token: SeDebugPrivilege 1396 NAPSTAT.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1188 Explorer.EXE 1188 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1188 Explorer.EXE 1188 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
e3cafecde4e7f884fb0a05a85dd018458e8751e0ab131217eafb8bba38750e44.exeExplorer.EXENAPSTAT.EXEdescription pid process target process PID 1264 wrote to memory of 996 1264 e3cafecde4e7f884fb0a05a85dd018458e8751e0ab131217eafb8bba38750e44.exe svchost.exe PID 1264 wrote to memory of 996 1264 e3cafecde4e7f884fb0a05a85dd018458e8751e0ab131217eafb8bba38750e44.exe svchost.exe PID 1264 wrote to memory of 996 1264 e3cafecde4e7f884fb0a05a85dd018458e8751e0ab131217eafb8bba38750e44.exe svchost.exe PID 1264 wrote to memory of 996 1264 e3cafecde4e7f884fb0a05a85dd018458e8751e0ab131217eafb8bba38750e44.exe svchost.exe PID 1264 wrote to memory of 996 1264 e3cafecde4e7f884fb0a05a85dd018458e8751e0ab131217eafb8bba38750e44.exe svchost.exe PID 1264 wrote to memory of 996 1264 e3cafecde4e7f884fb0a05a85dd018458e8751e0ab131217eafb8bba38750e44.exe svchost.exe PID 1264 wrote to memory of 996 1264 e3cafecde4e7f884fb0a05a85dd018458e8751e0ab131217eafb8bba38750e44.exe svchost.exe PID 1188 wrote to memory of 1396 1188 Explorer.EXE NAPSTAT.EXE PID 1188 wrote to memory of 1396 1188 Explorer.EXE NAPSTAT.EXE PID 1188 wrote to memory of 1396 1188 Explorer.EXE NAPSTAT.EXE PID 1188 wrote to memory of 1396 1188 Explorer.EXE NAPSTAT.EXE PID 1396 wrote to memory of 1800 1396 NAPSTAT.EXE cmd.exe PID 1396 wrote to memory of 1800 1396 NAPSTAT.EXE cmd.exe PID 1396 wrote to memory of 1800 1396 NAPSTAT.EXE cmd.exe PID 1396 wrote to memory of 1800 1396 NAPSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e3cafecde4e7f884fb0a05a85dd018458e8751e0ab131217eafb8bba38750e44.exe"C:\Users\Admin\AppData\Local\Temp\e3cafecde4e7f884fb0a05a85dd018458e8751e0ab131217eafb8bba38750e44.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\svchost.exe"C:\\Windows\\SysWow64\\svchost.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWow64\svchost.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/996-67-0x0000000000120000-0x0000000000130000-memory.dmpFilesize
64KB
-
memory/996-66-0x0000000000950000-0x0000000000C53000-memory.dmpFilesize
3.0MB
-
memory/996-59-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/996-60-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/996-63-0x000000000041CFD0-mapping.dmp
-
memory/996-65-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1188-77-0x0000000006AF0000-0x0000000006BF4000-memory.dmpFilesize
1.0MB
-
memory/1188-75-0x0000000006AF0000-0x0000000006BF4000-memory.dmpFilesize
1.0MB
-
memory/1188-68-0x0000000006410000-0x0000000006545000-memory.dmpFilesize
1.2MB
-
memory/1264-58-0x0000000000640000-0x0000000000644000-memory.dmpFilesize
16KB
-
memory/1264-56-0x0000000000620000-0x0000000000648000-memory.dmpFilesize
160KB
-
memory/1264-55-0x00000000005C0000-0x00000000005FC000-memory.dmpFilesize
240KB
-
memory/1264-57-0x0000000000620000-0x0000000000636000-memory.dmpFilesize
88KB
-
memory/1264-54-0x000000013F620000-0x000000013F662000-memory.dmpFilesize
264KB
-
memory/1396-71-0x00000000005D0000-0x0000000000616000-memory.dmpFilesize
280KB
-
memory/1396-73-0x0000000001E70000-0x0000000002173000-memory.dmpFilesize
3.0MB
-
memory/1396-72-0x0000000000080000-0x00000000000A8000-memory.dmpFilesize
160KB
-
memory/1396-74-0x0000000000530000-0x00000000005BF000-memory.dmpFilesize
572KB
-
memory/1396-69-0x0000000000000000-mapping.dmp
-
memory/1396-76-0x0000000000080000-0x00000000000A8000-memory.dmpFilesize
160KB
-
memory/1800-70-0x0000000000000000-mapping.dmp